TA577 is a cybercrime group known for widespread spearphishing delivering loaders like Pikabot, QakBot, and Latrodectus.
TA577 (Hive0118) is a prolific cybercrime group active since mid-2020, broadly targeting various industries and geographies. They primarily use spearphishing links for initial access, followed by executing loaders like Pikabot, QakBot, and Latrodectus via Windows Command Shell and JavaScript. Defenders should harden email security, enhance user awareness against suspicious links, and actively monitor for execution patterns and network anomalies associated with these malware families.
TA577 is a prolific cybercrime threat actor tracked by Proofpoint since mid-2020. This actor conducts broad targeting across various industries and geographies, and Proofpoint has observed TA577 deliver payloads including Qbot, IcedID, SystemBC, SmokeLoader, Ursnif, and Cobalt Strike.
Monitor for suspicious email account activity and implement robust email account security measures.
Detect and block suspicious links in emails, and educate users about spearphishing tactics.
Monitor for suspicious Windows Command Shell and JavaScript activity, and restrict unnecessary script execution.
Inspect data for embedded payloads and implement controls to detect and prevent their execution.
TA577 primarily uses spearphishing links for initial access.
TA577 executes loader malware such as Pikabot, QakBot, and Latrodectus.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.