This attacker is an affiliate distributor of the The Trick, also known as Trickbot, and BazaLoader. (For more on how affiliates work, see the description of TA573). TA800 has targeted a wide range of industries in North America, infecting victims with banking Trojans and malware loaders (malware designed to download other malware onto a compromised device). Malicious emails have often included recipients’ names, titles and employers along with phishing pages designed to look like the targeted company. Lures have included hard-to-resist subjects such as related to payment, meetings, termination, bonuses and complaints in the subject line or body of the email.
The same group is tracked under different names by different vendors.
| Vendor | Name |
|---|---|
| Various | TA800 |
No techniques mapped yet.
No IOCs extracted yet from reports naming this actor.
Every report in the Global Intel Library that names TA800, newest first. Open any report to see the full analysis with provenance.
No reports in the Lore library name this actor yet.
Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to TA800. Each row shows why it was linked and where it came from.
No feed indicators linked to this actor yet. Feeds are checked every hour.
Open-source reports about this actor collected from MISP Galaxy.