TA2536

TA2536, which has been active since at least 2015, is likely Nigerian based on its unique linguistic style, tactics and tools. It uses keyloggers such as HawkEye and distinctive stylometric features in typo-squatted domains that resemble legitimate names and the use of recurring names and substrings in email addresses.

Qrupun mənşəyi Nigeriya kimi bildirilir.

Bu aktor haqqında dərc edilmiş hesabatlar:

• https://www.proofpoint.com/us/blog/threat-insight/dtpacker-net-packer-curious-password-1

Mənbə: MISP Galaxy, Malpedia.