TA551

Overview

TA551 is a financially-motivated threat group that has been active since at least 2018. The group has primarily targeted English, German, Italian, and Japanese speakers through email-based malware distribution campaigns.

Capabilities

• Custom malware/implant development — ATT&CK: 4 attributed custom malware families

TTPs — 14 techniques across 5 tactics

Tools & malware (5)

QakBot · IcedID · Valak · Sliver · Ursnif

Reporting (2)

• TA551: Email Attack Campaign Switches from Valak to IcedID — Duncan, B
• Evolution of Valak, from Its Beginnings to Mass Distribution — Duncan, B