TA2541
TA2541 is a cybercriminal group that has been targeting the aviation, aerospace, transportation, manufacturing, and defense industries since at least 2017. TA2541 campaigns are typically high volume and involve the use of commodity remote access tools obfuscated by crypters and themes related to aviation, transportation, and travel.
- ATT&CK ID
- G1018
- Techniques
- 20
- Tools
- 9
Techniques
Resource Development
Acquire InfrastructureObtain CapabilitiesStage Capabilities
Initial Access
Execution
Windows Management InstrumentationScheduled Task/JobCommand and Scripting InterpreterUser Execution
Persistence
Scheduled Task/JobBoot or Logon Autostart Execution
Privilege Escalation
Scheduled Task/JobProcess InjectionBoot or Logon Autostart Execution
Stealth
Obfuscated Files or InformationMasqueradingProcess InjectionSystem Binary Proxy Execution
Defense Impairment
Discovery
System Network Configuration DiscoverySystem Information DiscoverySoftware Discovery
Command and Control
Ingress Tool TransferDynamic ResolutionEncrypted Channel
Software
Agent Tesla · AsyncRAT · Imminent Monitor · NETWIRE · Revenge RAT · Snip3 · WarzoneRAT · jRAT · njRAT