TA570
DEV-0450
One of the most active Qbot malware affiliates, Proofpoint has tracked the large cybercrime threat actor TA570 since 2018.
origin (suspected)
Russia
source: misp-galaxy4 refs →
TA570· Russia
TA570 (DEV-0450) is an active Qbot malware affiliate tracked since 2018.
Analyst brief
TA570 (DEV-0450) is one of the most active Qbot malware affiliates, tracked by Proofpoint since 2018. This group targets organizations. Their characteristic TTPs include Qbot loader delivery via phishing email campaigns, thread hijacking, and leveraging existing email chains. Defenders should be vigilant for suspicious email attachments, especially unusual document macros leading to Qbot distribution.
unknown
FAQ2
What technique does TA570 primarily use in its attacks?
TA570 primarily uses tactics such as thread hijacking, leveraging existing email chains, and phishing email campaigns to deliver the Qbot loader.
What should defenders look for to detect TA570 activity?
Defenders should be vigilant for suspicious email attachments, especially unusual document macros leading to the distribution of Qbot.
See also5
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.