Ta569

Malware Profile Updated 2 months ago
Download STIX
Preview STIX
TA569 is a malware distributor that has been utilizing fake browser updates for over five years to deliver the SocGholish malware, according to cybersecurity firm Proofpoint. The threat actor has employed various methods to direct traffic from compromised websites to their controlled domains. In one notable instance last fall, TA569 compromised more than 250 US newspaper websites and served SocGholish malware to the publications' readers through malicious JavaScript-powered ads and videos. The malware, once in the system, can steal personal information, disrupt operations, or hold data for ransom. The threat actor uses sophisticated techniques such as Parrot TDS to obfuscate its injected code and apply filtering before routing requests to the Stage 2 domains. If a user downloads what they believe to be a regular update but the attacker is TA569, they inadvertently download the signature "SocGholish" initial access malware. Screenshots captured by security researcher Jerome Segura illustrate how TA569 and another cluster, "FakeSG," also known as "RogueRaticate," deploy fake updates. Proofpoint's senior manager of threat research, Daniel Blackford, has highlighted the ongoing activity of TA569 and the difficulties customers face in understanding and remediating the threat independently. The trend of using fake browser updates to distribute malware was initiated by TA569 and has since been adopted by at least four different threat clusters, indicating a growing and persistent trend. Other threat actors such as RogueRaticate (FakeSG), ZPHP (SmartApeSG), and EtherHiding are also known to employ similar tactics. Over the recent years, multiple groups including TA569 have been observed using the software as a Remote Access Trojan (RAT).
What's your take? (Question 1 of 5)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.
IDVotesProfile Description
Socgholish
3
SocGholish is a harmful malware known for its deceptive methods of infection, often impersonating legitimate browser updates to distribute Remote Access Trojans. This malicious software infiltrates systems through suspicious downloads, emails, or websites, typically without the user's knowledge. Onc
Fakesg
1
FakeSG is a recently identified malware that uses sophisticated obfuscation and delivery techniques, making it a serious threat. The malware mimics the notorious SocGholish distribution campaign, hence its name - "FakeSG". It has different browser templates, altering its appearance based on the vict
Rogueraticate
1
RogueRaticate is a malicious software (malware) designed to exploit and damage computer systems. This harmful program can enter your system through suspicious downloads, emails, or websites, often without the user's knowledge. Once it has infiltrated a system, RogueRaticate can steal personal inform
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Malware
Proofpoint
Rat
Associated Malware
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
SmartapesgUnspecified
1
None
Associated Threat Actors
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Associated Vulnerabilities
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Source Document References
Information about the Ta569 Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
SourceCreatedAtTitle
CERT-EU
9 months ago
Watch Out: Attackers Are Hiding Malware in 'Browser Updates'
InfoSecurity-magazine
9 months ago
Fake Browser Updates Used in Malware Distribution
BankInfoSecurity
9 months ago
Fake Browser Updates Used to Deploy Malware
CERT-EU
8 months ago
ClearFake Campaign Expands to Target Mac Systems with Atomic Stealer
Securityaffairs
8 months ago
Experts warn of a surge in NetSupport RAT attacks
CERT-EU
a year ago
These 3 loaders were behind 80% of intrusions this year