File · TA2541 · Unknown · misp-galaxy + mitre-attack · refreshed 2026-10-06
TA2541
attack rose · 28 techniques across 8 tactics
Analyst brief
misp-galaxy + mitre-attackPersistent cybercrime threat actor targeting aviation, aerospace, transportation, manufacturing, and defense industries for years. This threat actor consistently uses remote access trojans (RATs) that can be used to remotely control compromised machines. This threat actor uses consistent themes related to aviation, transportation, and travel. The threat actor has used similar themes and targeting since 2017.
Kill chain
MITRE ATT&CK Enterprise · tap a technique28 techniques · 8 of 15 tactics
Resource development
5 techniquesInitial access
2 techniquesExecution
6 techniquesPersistence
1 techniqueStealth
7 techniquesDefense impairment
1 techniqueDiscovery
3 techniquesCommand and control
3 techniques
select a technique
Arsenal
7 malware · 2 toolsas stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id
Primary-source reports
via APTnotes · linked, never re-hostedTake it with you
keyless · no signupReferences
3 sourcesTrack TA2541 on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.