TA2541 is a financially motivated cybercrime group targeting aviation sectors since 2017.
TA2541 is a persistent, financially motivated cybercrime group active since at least 2017. This actor primarily targets aviation, aerospace, transportation, manufacturing, and defense industries. TA2541 relies on spearphishing campaigns themed around aviation and travel for initial access, followed by TTPs like persistence establishment to deploy an array of RATs including Revenge RAT, AsyncRAT, Agent Tesla, and njRAT. Defenders should monitor for persistence mechanisms (e.g., Scheduled Tasks, Registry Run Keys), block suspicious spearphishing attempts, and track C2 traffic using Asymmetric Cryptography associated with these RATs.
Persistent cybercrime threat actor targeting aviation, aerospace, transportation, manufacturing, and defense industries for years. This threat actor consistently uses remote access trojans (RATs) that can be used to remotely control compromised machines. This threat actor uses consistent themes related to aviation, transportation, and travel. The threat actor has used similar themes and targeting since 2017.
Monitor and block malware hosting and uploading activities.
Enhance email security measures against suspicious spearphishing attachments and links.
Monitor scheduled task creation and suspicious link execution.
Monitor and restrict Registry Run Keys and Startup Folder modifications.
Detect suspicious software packing and legitimate resource name masquerading activities.
Monitor system information and security software discovery activities.
Monitor and block suspicious ingress tool transfer and asymmetric cryptography usage.
Take measures against security tool disablement and modification.
TA2541 primarily targets critical sectors such as aviation, aerospace, transportation, manufacturing, and defense industries.
TA2541 relies on spearphishing campaigns themed around aviation and travel for initial access.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.