TA4903
- Primary motivation
- financial-gain
- Sophistication
- intermediate
- Resource level
- team
- Actor type
- criminal
- Profile updated
- 2026-07-07 12:16:51
Targeted industries: financial-services government-and-public-sector professional-services
Targeted regions: country_code:us
Context
TA4903 is a financially motivated threat actor known for conducting credential phishing and business email compromise campaigns. They target organizations in the U.S. across various sectors, spoofing government entities and private businesses. The actor has been observed using techniques such as QR codes in phishing campaigns and spoofing supplier domains to prompt victims to provide banking information. TA4903's activities typically involve stealing corporate credentials to facilitate follow-on BEC activities.
Reports & references
- proofpoint.com — Ta4903 Actor Spoofs Us Government Small Businesses Phishing Bec Bids (report)