Ta544

TA544 is a financially motivated, advanced persistent threat (APT) actor that has been tracked by cybersecurity firm Proofpoint and others since at least 2017. This malicious actor typically uses Ursnif malware to target organizations, predominantly in Italy and Japan. The Ursnif banking trojan, also known as Gozi, is among the variety of malware tools that TA544 has deployed over the years. More recently, TA544 has been associated with the distribution of a sophisticated second-stage downloader called WikiLoader. Throughout 2022, TA544 was observed targeting Italian organizations with IcedID and Ursnif. In December 2022, Proofpoint first identified WikiLoader being delivered by TA544, primarily aimed at Italian firms. Following this initial identification, multiple subsequent campaigns were observed, the majority of which continued to target Italian organizations. These operations were part of broader phishing campaigns that also involved another threat actor, TA551. In addition to these activities, TA544 has been implicated in abusing the vulnerability CVE-2023-36025, as reported by a Proofpoint researcher. This abuse was part of a campaign involving Remcos, a remote access Trojan used by various threat actors over the years to remotely control and monitor compromised Windows devices. This activity coincided with a surge in campaigns distributing DarkGate and PikaBot, where TA544 leveraged new variants of loader malware, such as IDAT Loader, to deploy Remcos RAT or SystemBC malware.