Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · TA578 · Unknown · misp-galaxy + mitre-attack · refreshed 2026-10-06

TA578

MITRE G1038 ↗

TA578 — ATT&CK roseTA

attack rose · 4 techniques across 3 tactics

Analyst brief

misp-galaxy + mitre-attack

TA578, a threat actor that Proofpoint researchers have been tracking since May of 2020. TA578 has previously been observed in email-based campaigns delivering Ursnif, IcedID, KPOT Stealer, Buer Loader, BazaLoader, and Cobalt Strike.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

4 techniques · 3 of 15 tactics

  1. Reconnaissance

    1 technique

  2. Resource development

    1 technique

  3. Execution

    2 techniques

select a technique

Arsenal

3 malware
Malware
Malware · 3ATT&CK
BumblebeeS1039 ↗
LatrodectusS1160 ↗
IcedIDS0483 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Take it with you

keyless · no signup

References

4 sources
  1. 1.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming
  2. 2.attack.mitre.org/groups/G1038
  3. 3.bitsight.com/blog/latrodectus-are-you-coming-back
  4. 4.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice

Track TA578 on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.