TA551

Overview

TA551 is a financially-motivated threat group that has been active since at least 2018. The group has primarily targeted English, German, Italian, and Japanese speakers through email-based malware distribution campaigns.

Naming & attribution

TA551 is tracked under 3 names across the industry. It uses 14 documented ATT&CK techniques — more than 40% of the 174 groups tracked here. Activity attributed since at least 2018.

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

• T1568.002 Domain Generation Algorithms — used by 2 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• LazyScripter — 8 shared techniques (31% overlap)
• Nomadic Octopus Russia — 5 shared techniques (31% overlap)
• Rancor — 5 shared techniques (28% overlap)
• APT19 China — 7 shared techniques (25% overlap)
• WIRTE — 7 shared techniques (21% overlap)
• PLATINUM — 4 shared techniques (19% overlap)

Capabilities

• Custom malware/implant development — ATT&CK: 4 attributed custom malware families

TTPs — 14 techniques across 5 tactics

Tools & malware (5)

QakBot · IcedID · Valak · Sliver · Ursnif

Reporting (2)

• TA551: Email Attack Campaign Switches from Valak to IcedID — Duncan, B
• Evolution of Valak, from Its Beginnings to Mass Distribution — Duncan, B