Team46, also known as TaxOff, is a sophisticated APT group known for exploiting zero-day vulnerabilities to target Russian entities.
Analyst brief
Team46, also aliased as TaxOff, is a sophisticated APT group active since at least late 2024, targeting Russian government, academic, and media organizations. They use spearphishing emails disguised as forum invitations to exploit zero-day vulnerabilities like CVE-2025-2783, deploying multi-stage loaders and the Trinper backdoor with machine-specific encryption keys. Defenders should monitor for HTTPS C2 traffic with domain fronting, unusual firmware UUID access, and spearphishing attempts mimicking service notifications.
Team46
TaxOff
unknown
Team46 is a sophisticated APT group active since at least late 2024, targeting Russian government, academic, and media organizations through spearphishing emails disguised as forum invitations or service notifications. They exploit zero-day vulnerabilities like CVE-2025-2783 in Google Chrome (March 2025, Operation ForumTroll) and CVE-2024-6473 in Yandex Browser, deploying multi-stage loaders (e.g., winsta.dll, donut shellcode) that decrypt payloads using machine-specific keys like firmware UUID for environmental guardrails. Key malware includes the Trinper backdoor for keylogging, clipboard theft, file/process discovery, and encrypted C2 exfiltration over HTTPS with domain fronting, alongside auxiliary .NET tools (dirlist.exe, ProcessList.exe) and variants using Cobalt Strike or Dante backdoor; the group employs obfuscation, AMSI bypasses, debugger evasion, and self-deletion for persistence and stealth. Positive Technologies attributes TaxOff operations to Team46 based on identical PowerShell patterns, loaders, and hyphenated CDN-mimicking infrastructure (e.g., ms-appdata-*.global.ssl.fastly.net).
How does the Team46 group gain initial access to target networks?+
The Team46 APT group targets Russian government, academic, and media organizations by spreading via spearphishing emails disguised as forum invitations or service notifications.
Which critical Google Chrome vulnerability has Team46 exploited in their operations?+
The Team46 group exploits the Google Chrome zero-day vulnerability CVE-2025-2783.