TA551

First seen

2018-01-01 00:00:00

Primary motivation

financial-gain

Sophistication

intermediate

Resource level

organization

Actor type

criminal

Related IoCs

238 (143 malicious)

Last IoC activity

2026-10-18 02:23:48

Profile updated

2026-07-07 12:00:06

Targeted industries: financial-services government-and-public-sector

Targeted regions: country_code:us country_code:de country_code:it country_code:jp

Context

TA551 is a financially-motivated threat group that has been active since at least 2018. The group has primarily targeted English, German, Italian, and Japanese speakers through email-based malware distribution campaigns.

Recent IoC activity

143 malicious indicators in Maltiverse are attributed to TA551 (G0127). The 20 most recently updated:

Detection coverage

• 39 YARA rules
• 283 Sigma rules

Malware & tools used

• Regsvr32 (attack-pattern)
• Email Addresses (attack-pattern)
• Malicious File (attack-pattern)
• Rundll32 (attack-pattern)
• Steganography (attack-pattern)
• Spearphishing Attachment (attack-pattern)
• Standard Encoding (attack-pattern)
• Domain Generation Algorithms (attack-pattern)
• Command Obfuscation (attack-pattern)
• Web Protocols (attack-pattern)
• Ingress Tool Transfer (attack-pattern)
• Mshta (attack-pattern)
• Windows Command Shell (attack-pattern)
• Masquerading (attack-pattern)
• Sliver (malware)
• Ursnif (malware)
• IcedID (malware)
• Valak (malware)
• QakBot (malware)

Reports & references

• secureworks.com — Gold Cabin (report)
• MITRE ATT&CK — G0127 (report)
• Palo Alto Unit 42 — Monsterlibra (report)
• Palo Alto Unit 42 — Ta551 Shathak Icedid (report)
• Palo Alto Unit 42 — Valak Evolution (report)

External references

• mitre-attack — G0127
• GOLD CABIN
• Shathak
• Unit 42 Valak July 2020
• Unit 42 TA551 Jan 2021
• Secureworks GOLD CABIN
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy