{
  "name": "Secret Message: Steganography Tricks of TA558 Group in Cyber Attacks on Enterprises in Russia and Belarus",
  "slug": "secret-message-steganography-tricks-of-ta558-group-in-cyber-attacks-on-enterprises-in-russia-and-belarus",
  "description": "F.A.C.C.T.'s Threat Intelligence analysts have investigated numerous cyberattacks by the TA558 group targeting enterprises, government institutions, and banks in Russia and Belarus. The attacks aimed to steal data and gain access to the organization's internal systems. TA558 used multi-stage phishing campaigns, malware distribution, and advanced social engineering techniques, including steganography to conceal malicious payloads within images and encoded text files. The group leveraged legitimate compromised SMTP servers and created email accounts masquerading as legitimate organizations to distribute malicious emails with malware such as Agent Tesla and Remcos.",
  "published": "2024-07-30T13:54:14+00:00",
  "created_at": "2024-07-30T13:54:14+00:00",
  "modified_at": "2024-07-30T14:31:36+00:00",
  "created_at_opencti": "2024-07-30T13:54:14+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-07-30",
    "CVE-2017-11882",
    "agent-tesla",
    "belarus",
    "malware",
    "phishing",
    "remcos",
    "russia",
    "social engineering",
    "steganography"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "75.102.51.237"
      },
      {
        "id": "",
        "name": "70.34.197.128"
      },
      {
        "id": "",
        "name": "45.79.137.187"
      },
      {
        "id": "",
        "name": "45.74.19.84"
      },
      {
        "id": "",
        "name": "45.56.102.63"
      },
      {
        "id": "",
        "name": "185.236.228.95"
      },
      {
        "id": "",
        "name": "216.9.224.70"
      },
      {
        "id": "",
        "name": "139.144.212.135"
      },
      {
        "id": "",
        "name": "213.142.149.158"
      },
      {
        "id": "",
        "name": "www.metabaseq.com"
      },
      {
        "id": "",
        "name": "www.autosmtp.com"
      },
      {
        "id": "",
        "name": "https://www.autosmtp.com"
      },
      {
        "id": "",
        "name": "https://www.metabaseq.com/ta588/"
      },
      {
        "id": "",
        "name": "https://cyble.com/blog/threat-actor-employs-powershell-backed-steganography-in-recent-spam-campaigns/"
      },
      {
        "id": "",
        "name": "http://tt.vg/IsjCX"
      },
      {
        "id": "",
        "name": "http://tt.vg/PqPsi"
      },
      {
        "id": "",
        "name": "http://tau.id/ze87s"
      },
      {
        "id": "",
        "name": "http://tau.id/y3kre"
      },
      {
        "id": "",
        "name": "http://tau.id/c9izr"
      },
      {
        "id": "",
        "name": "http://tau.id/34x8c"
      },
      {
        "id": "",
        "name": "http://tau.id/0vzd8"
      },
      {
        "id": "",
        "name": "http://l-to.com/ru7285wa"
      },
      {
        "id": "",
        "name": "http://qr-in.com/HDYwZbx"
      },
      {
        "id": "",
        "name": "http://shtu.be/e79171"
      },
      {
        "id": "",
        "name": "http://139.144.212.135/sbi/microsoftupdationgoingformicrftofficeupgradingtonewmsofficeprotoecoltoreducethesystemwrking.doc."
      },
      {
        "id": "",
        "name": "http://isols.co/zXTgU"
      },
      {
        "id": "",
        "name": "http://en0.de/serverrrrr"
      },
      {
        "id": "",
        "name": "http://139.144.212.135/222/GST.xn--txt-to0a"
      },
      {
        "id": "",
        "name": "biatr.ooguy.com"
      },
      {
        "id": "",
        "name": "withheldforprivacy.com"
      },
      {
        "id": "",
        "name": "vervo.lat"
      },
      {
        "id": "",
        "name": "qr-in.com"
      },
      {
        "id": "",
        "name": "shtu.be"
      },
      {
        "id": "",
        "name": "pluse-tr.com"
      },
      {
        "id": "",
        "name": "naft-dz.shop"
      },
      {
        "id": "",
        "name": "midae.com"
      },
      {
        "id": "",
        "name": "maximum.icu"
      },
      {
        "id": "",
        "name": "laceys.icu"
      },
      {
        "id": "",
        "name": "l-to.com"
      },
      {
        "id": "",
        "name": "isols.co"
      },
      {
        "id": "",
        "name": "executivesship.com"
      },
      {
        "id": "",
        "name": "bcmsrll.com"
      },
      {
        "id": "",
        "name": "baltictransline.store"
      },
      {
        "id": "",
        "name": "bsmsrll.com"
      },
      {
        "id": "",
        "name": "abspedition.icu"
      },
      {
        "id": "",
        "name": "automaxtool.me"
      },
      {
        "id": "",
        "name": "akcalogistics.shop"
      },
      {
        "id": "",
        "name": "export@bcmsrll.com"
      },
      {
        "id": "",
        "name": "info@bcmsrll.com"
      },
      {
        "id": "",
        "name": "expo@bcmsrll.com"
      },
      {
        "id": "",
        "name": "contact@bcmsrll.com"
      },
      {
        "id": "",
        "name": "fda7e2d7a3ee70355988afc70ee4d6ebf08b76ef38f4504aa1cf5f8fa9a99b2e"
      },
      {
        "id": "",
        "name": "eecb89aaf97fa8333c2c56c16e3905b2b2764271d7f7944bc71a8aba64d2906c"
      },
      {
        "id": "",
        "name": "ea17ccf4bf55f23b8a93f8e17e470be440211f463d5b7e01958843c8c160f765"
      },
      {
        "id": "",
        "name": "e2ee9ac33c1e07a99f8cc6044f0a7b830e892fbfbfd7d6e8db916707e9c34035"
      },
      {
        "id": "",
        "name": "d5e214f3096564dfc3e348b6a3ac6aeefed75d785ac7cfab5d3019f67fdbc9be"
      },
      {
        "id": "",
        "name": "c0e49a1256f7e6b66607f2440219ce5e684bd591fc1fb7c64b90e9b9218374a9"
      },
      {
        "id": "",
        "name": "bc46b7b44928f6ad586d787db33f53ed962aab72441a5518efb3e971d36a40e2"
      },
      {
        "id": "",
        "name": "a2d5c106ced87a5771490d95bc20c385f8ae49f7e8448b2e68a3c6bf0d96d03b"
      },
      {
        "id": "",
        "name": "91a14852328b337a5aa1046bc7f92448f2c0a3c2ec5a8a76729de68521fa2a39"
      },
      {
        "id": "",
        "name": "8d12cfdb1376c99139b8dba94a0c02357bf7652b763d6313d70dde912266905f"
      },
      {
        "id": "",
        "name": "6b19f6c758c0b626d1319314e9679d55701e156a9642409e8899a1e7d6a20026"
      },
      {
        "id": "",
        "name": "89eb53096ec6248185c7797c802d1bd9b539097f01592bfe5f9e183d753d20ce"
      },
      {
        "id": "",
        "name": "4d97a5069b154b2e95af235dd32c82c1bf5b2e4cf2d188067da223f488ebaa48"
      },
      {
        "id": "",
        "name": "55f02d8a8f8fe958eeb020593b48d25c86238bd2a7746b9c7b7e4afa9e88c315"
      },
      {
        "id": "",
        "name": "4cc7a5fe2d2ffafda3791f0e9cced8f7fe430b598551c2a9277210e87e6df53b"
      },
      {
        "id": "",
        "name": "383ee0319fade807fd02f12a92d4f2b98ba7137f27212b996f3cc9bd88f278ac"
      },
      {
        "id": "",
        "name": "32562e2a917d9827d3f24ac715a6af7468d627594c90126641349d25b735234f"
      },
      {
        "id": "",
        "name": "295aef7c1199c1f1ed7d487694e977ec858c5819140ed09808e175fcc49472f0"
      },
      {
        "id": "",
        "name": "18b8e4782b590141ff10ecde5b76bd1e35d99890a517741ac71408a478a56a81"
      },
      {
        "id": "",
        "name": "110502c15e51f07fe6aff0b0a28d128d60a1eb51df09a2b9fb2db0775fe92f28"
      },
      {
        "id": "",
        "name": "0f9a81081fd7ff58c83c78bcfa4735556fd3ad823f917fe28787085f2d309336"
      },
      {
        "id": "",
        "name": "079de6fa0a294bbab99ca481e03e5d0360cdfae1ab41ffd7cc37a92d7bcc25a1"
      },
      {
        "id": "",
        "name": "041c9c4e5242464f8661c6f611da14041447b368e7ff669e5de89e9f805ba486"
      }
    ],
    "malware": [
      {
        "id": "23c1ea77-7be5-4568-a033-3ebf582884b0",
        "name": "Agent Tesla - S0331",
        "slug": "agent-tesla-s0331"
      },
      {
        "id": "29d292f7-f50d-4c23-900d-035ab7488290",
        "name": "Remcos",
        "slug": "remcos"
      }
    ],
    "intrusion_sets": [
      {
        "id": "9c80c103-af34-4ccb-9d4c-8d6e566e28df",
        "name": "TA558",
        "slug": "ta558"
      }
    ],
    "vulnerabilities": [
      {
        "id": "",
        "name": "CVE-2017-11882"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Belarus"
      },
      {
        "id": "",
        "name": "Russian Federation"
      },
      {
        "id": "",
        "name": "Finance"
      },
      {
        "id": "",
        "name": "Government"
      }
    ]
  },
  "external_refs": [
    "https://www.facct.ru/blog/ta558/",
    "https://otx.alienvault.com/pulse/66a90ca6796260d3686ab946"
  ]
}