TA4903 is a financially motivated cybercriminal group known for QR code phishing and business email compromise.
Analyst brief
TA4903 is a financially motivated cybercriminal group primarily targeting organizations in the U.S. across various sectors to facilitate credential theft and business email compromise (BEC). Their key TTPs include credential phishing attacks that abuse QR codes, spoofing supplier domains, and using social engineering to trick victims into divulging banking information. Defenders should prioritize monitoring for sophisticated phishing emails, unusual payment instruction requests or supplier information changes, and enforce strong credential protection measures like MFA to mitigate the risk of follow-on BEC activities.
TA4903
unknown
TA4903 is a financially motivated threat actor known for conducting credential phishing and business email compromise campaigns. They target organizations in the U.S. across various sectors, spoofing government entities and private businesses. The actor has been observed using techniques such as QR codes in phishing campaigns and spoofing supplier domains to prompt victims to provide banking information. TA4903's activities typically involve stealing corporate credentials to facilitate follow-on BEC activities.