Forensia CTI Core

Profile

TA577 is an initial access broker (IAB) that has distributed QakBot and Pikabot, and was among the first observed groups distributing Latrodectus in 2023.

MITRE ATT&CK ↗

Techniques

6 ATT&CK techniques attributed to this actor.

T1027.009 Embedded Payloads T1059.003 Windows Command Shell T1059.007 JavaScript T1204.001 Malicious Link T1566.002 Spearphishing Link T1586.002 Email Accounts

Software

3 malware/tools attributed to this actor.

QakBotPikabotLatrodectus

Related corpus activity

8,035 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to TA577.

Indicator	Type	Family	Sev	Src
cve-2026-0740	cve	—	85	1
cve-2026-1969	cve	—	85	1
cve-2025-12057	cve	—	85	1
cve-2025-34085	cve	—	85	1
cve-2023-44976	cve	ransomware	85	2
cve-2026-4368	cve	ransomware	85	1
cve-2021-29441	cve	—	85	1
cve-2026-3844	cve	—	85	1
cve-2025-7852	cve	—	85	1
cve-2025-7443	cve	—	85	1
4ce45e016a304d813e67b29a08265b2101c2e15a09ace5de6539cad02567affe	sha256	supply_chain	80	1
221a39856b37e3c682f62427f1e6b965b36a2405764689c914672770a01a1fa9	sha256	—	80	1
60972abf5425c191c81bae117f1dedaea13d39bc52f367d5dff9ad1aa4b9c5ca	sha256	phishing	80	2
62a879b0d1c1649cc72b2b6f61a8f6bd888625ce6e8a7aefe0a0461e4f27c525	sha256	phishing	80	2
669002654c264191d4660fbf757860d930175649735f81370b9f1af3658a304c	sha256	phishing	80	2
7b297f18ece81e87608e158288cc9c06cb9f4a8f1b2d2256aecf7bba8d7be2ab	sha256	phishing	80	2
7b7981c99d59595fe15377df84695bb72ce0b85560a3935f930657b2d162e5ef	sha256	phishing	80	1
771a47120b935e218322046e838347d722d265b91f1afdef91194a5bec86a97a	sha256	phishing	80	2
5272917261d7091a59e00f9d09cd7eb1d3e111115a5b367f79a66d0d7c7b01f4	sha256	phishing	80	2
5115277eabf2d22d49dcef1e155874387d8e783853bd86debf7ff58588aae35d	sha256	phishing	80	2
a7bd8869293212e1671df90d2d41b96d4933eb9408b1111bd830e111a91bb202	hash	phishing	80	2
6c6cbed6aad96564ed87094785be07a1	hash	phishing	80	2
9758e76b601798a30d903bf05052a53df80451e5c156548ce9da828f608b6470	sha256	—	80	1
5ab41cf20315d2ea1385967d588159873a65ef5581a0b78de06c0d8617894194	sha256	phishing	80	2
55d6238b01a177e25eb7d53c943f3abea64ec073	hash	phishing	80	2
61e9d76f07334843df561fe4bac449fb6fdaed5e5eb91480bded225f3d265c5f	hash	phishing	80	2
22de84e8f29cba932cf65cf4dc1d333cb8b2e468204f97030712bee32691ac3b	sha256	phishing	80	2
50ebf107d522326c9a9db8821fe3263aa5136964faaf5dd183657bbb52725f84	sha256	phishing	80	2
44a4ac119349f525d877728b53fe38453a516881d577679caf08ab69312a695f	sha256	phishing	80	2
7900c2772680523cadc9fe4e07300d45500191ba64ff5b91573531b133840b14	sha256	phishing	80	2

Showing the top 30 by severity of 8,035.