Highlighting TA866/Asylum Ambuscade Activity Since 2021
Summary: Cisco Talos reports that TA866, also called Asylum Ambuscade, has run intrusion operations since at least 2020 and continued evolving its tooling and tactics from early 2023, using malspam and malvertising to route victims through traffic distribution systems such as 404 TDS. The campaigns typically deliver WasabiSeed, Screenshotter and AHK Bot, with Talos assessing with high confidence that TA866 also sometimes deploys a persistent backdoor called Resident, CSharp-Streamer-RAT, Cobalt Strike and Rhadamanthys, plus utilities like AdFind and remote access tools AnyDesk and Remote Utilities.
Why it matters: Talos observed extended gaps between initial access and the delivery of follow-on payloads, so an infection that looks contained may simply be a system the actor is still deciding whether to keep - and the same certificate-generation algorithm tied one 2024 CSharp-Streamer-RAT server to a 2023 TA866 intrusion.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026