Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · TA570 · Unknown · assessed origin Russia · misp-galaxy · refreshed 2026-10-06

TA570

  • DEV-0450

sigil · no ATT&CK coverage stated

What changed

ledger · newest first
  1. 2026-10-18todaynew CVE1 new CVE: CVE-2022-30190

Analyst brief

misp-galaxy

One of the most active Qbot malware affiliates, Proofpoint has tracked the large cybercrime threat actor TA570 since 2018.

CVEs TA570 is cited as exploiting

none on KEV
  1. CVE-2022-301902026-10-17
    1. “On Tuesday, Proofpoint shared evidence that a threat actor they’ve named “TA570” – who they’ve been tracking since 2018 and is heavily associated with the Qbot malware – is now using CVE-2022-30190 to deliver the popular malware used to steal banking information.”

      cited as exploiting · source: therecord.media ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

4 sources
  1. 1.proofpoint.com/us/blog/threat-insight/first-step-initial-access-leads…
  2. 2.therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-…
  3. 3.isc.sans.edu/diary/TA570+Qakbot+Qbot+tries+CVE202230190+Follina+exp…
  4. 4.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service…

Track TA570 on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.