Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · TA577 · Unknown · assessed origin Russia · misp-galaxy + mitre-attack · refreshed 2026-10-06

TA577

  • Hive0118

MITRE G1037 ↗

TA577 — ATT&CK roseTA

attack rose · 6 techniques across 4 tactics

Analyst brief

misp-galaxy + mitre-attack

TA577 is a prolific cybercrime threat actor tracked by Proofpoint since mid-2020. This actor conducts broad targeting across various industries and geographies, and Proofpoint has observed TA577 deliver payloads including Qbot, IcedID, SystemBC, SmokeLoader, Ursnif, and Cobalt Strike.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

6 techniques · 4 of 15 tactics

  1. Resource development

    1 technique

  2. Initial access

    1 technique

  3. Execution

    3 techniques

  4. Stealth

    1 technique

select a technique

Arsenal

3 malware
Malware
Malware · 3ATT&CK
PikabotS1145 ↗
QakBotS0650 ↗
LatrodectusS1160 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Take it with you

keyless · no signup

References

6 sources
  1. 1.proofpoint.com/us/blog/threat-insight/first-step-initial-access-leads…
  2. 2.thehackernews.com/2021/06/ransomware-attackers-partnering-with.html
  3. 3.itpro.com/security/ransomware/359919/ransomware-criminals-look-t…
  4. 4.exchange.xforce.ibmcloud.com/threat-group/guid:1dda890fa2662ed26b451c703e922315
  5. 5.attack.mitre.org/groups/G1037
  6. 6.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice

Track TA577 on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.