Moskalvzapoe
Aliases: MAN1, TA511
- First seen
- 2017-01-01 00:00:00
- Primary motivation
- financial-gain
- Sophistication
- advanced
- Resource level
- organization
- Actor type
- criminal
- Profile updated
- 2026-07-07 12:03:42
Targeted industries: financial-services
Targeted regions: country_code:us country_code:gb country_code:de
Context
Moskalvzapoe, also known as MAN1 or TA511, is a financially motivated threat actor group known for deploying malspam campaigns targeting the financial sector. They are recognized for using sophisticated techniques to distribute banking Trojans, primarily focusing on English-speaking countries.
Detection coverage
- 2 YARA rules
Malware & tools used
- Hancitor (malware)
Reports & references
- medium.com — Man1 Moskal Hancitor And A Side Of Ransomware D77B4D991618 (report)
- vixra.org — 1902.0257 (report)
- Palo Alto Unit 42 — Hancitor Infections Cobalt Strike (report)
- Palo Alto Unit 42 — Threat Brief Hancitor Actors (report)