TA482
- First seen
- 2022-01-01 00:00:00
- Origin
- TR
- Primary motivation
- ideology
- Sophistication
- intermediate
- Resource level
- government
- Actor type
- nation-state
- Profile updated
- 2026-07-07 11:50:41
Targeted industries: media-and-entertainment
Targeted regions: country_code:us
Context
Since early 2022, Proofpoint researchers have observed a prolific threat actor, tracked as TA482, regularly engaging in credential harvesting campaigns that target the social media accounts of mostly US-based journalists and media organizations. This victimology, TA482’s use of services originating from Turkey to host its domains and infrastructure, as well as Turkey’s history of leveraging social media to spread pro-President Recep Tayyip Erdogan and pro-Justice and Development Party (Turkey’s ruling party) propaganda support Proofpoint’s assessment that TA482 is aligned with the Turkish state.
Reports & references
- proofpoint.com — Above Fold And Your Inbox Tracing State Aligned Activity Targeting Journalists (report)