Cybercrime
TA570
TA570 is classified as cybercrime.
- Origin
- Russia
- Also known as
- 1
One of the most active Qbot malware affiliates, Proofpoint has tracked the large cybercrime threat actor TA570 since 2018.
The group's reported origin is Russia.
Also known as: DEV-0450
Published reports on this actor:
- https://www.proofpoint.com/us/blog/threat-insight/first-step-initial-access-leads-ransomware
- https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/
- https://isc.sans.edu/diary/TA570+Qakbot+Qbot+tries+CVE202230190+Follina+exploit+msmsdt/28728
Source: MISP Galaxy, Malpedia.
Is your organization mentioned?
Search with your domain to check whether your organization appears in ransomware listings, leaked records, forums and Telegram channels.
Search your domainThreat Intelligence
Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.