TA2719 is a threat actor known for low-volume phishing with localized lures delivering NanoCore and AsyncRAT.
Analyst brief
TA2719 is a threat actor tracked by Proofpoint since March 2020, known for leveraging commodity remote access trojans like NanoCore and AsyncRAT. It conducts low-volume campaigns using localized lures that impersonate local banks, law enforcement, and shipping services. Primary TTPs involve localized phishing emails with colorful images delivering NanoCore or AsyncRAT payloads. Defenders should focus on detecting suspicious emails mimicking local financial and delivery institutions, monitoring network traffic for RAT C2 connections, and enhancing end-user awareness training.
TA2719
unknown
In late March 2020, Proofpoint researchers began tracking a new actor with a penchant for using NanoCore and later AsyncRAT, popular commodity remote access trojans (RATs). Dubbed TA2719 by Proofpoint, the actor uses localized lures with colorful images that impersonate local banks, law enforcement, and shipping services. Proofpoint has observed this actor send low volume campaigns to recipients in Austria, Chile, Greece, Hungary, Italy, North Macedonia, Netherlands, Spain, Sweden, Taiwan, United States, and Uruguay.