TA551

Also known as: GOLD CABIN · Shathak

Overview

TA551 is a financially-motivated threat group that has been active since at least 2018. The group has primarily targeted English, German, Italian, and Japanese speakers through email-based malware distribution campaigns.

Naming & attribution

TA551 is tracked under 3 names across the industry. It uses 14 documented ATT&CK techniques — more than 40% of the 174 groups tracked here. Activity attributed since at least 2018.

Who calls this group what — MITRE lists each alias with the report that used it, but not which vendor coined it.
Name	First reported by
GOLD CABIN	Secureworks
Shathak	Duncan, B

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

T1568.002 Domain Generation Algorithms — used by 2 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

LazyScripter — 8 shared techniques (31% overlap)
Nomadic Octopus Russia — 5 shared techniques (31% overlap)
Rancor — 5 shared techniques (28% overlap)
APT19 China — 7 shared techniques (25% overlap)
WIRTE — 7 shared techniques (21% overlap)
PLATINUM — 4 shared techniques (19% overlap)

Malware families with tracked indicators

One family attributed to TA551, with 294 deduplicated indicators observed across abuse.ch ThreatFox, MalwareBazaar, URLhaus and SSLBL over the corpus's window (up to three years, as of 2026-09-27). MITRE documents what a group does; these are the indicators its malware families have surfaced in that window.

Sliver 294 indicators

Browse or copy the indicators by hash, domain, IP or URL, filtered by age from 1 day to 3 years.

Capabilities

Custom malware/implant development — ATT&CK: 4 attributed custom malware families

TTPs — 14 techniques across 5 tactics

Stealth

T1027.003 Steganography
T1027.010 Command Obfuscation
T1036 Masquerading
T1218.005 Mshta
T1218.010 Regsvr32
T1218.011 Rundll32

Command and Control

T1071.001 Web Protocols
T1105 Ingress Tool Transfer
T1132.001 Standard Encoding
T1568.002 Domain Generation Algorithms

Tools & malware (5)

QakBot · IcedID · Valak · Sliver · Ursnif

Reporting (2)

TA551: Email Attack Campaign Switches from Valak to IcedID — Duncan, B
Evolution of Valak, from Its Beginnings to Mass Distribution — Duncan, B