TA551: Email Attack Campaign Switches from Valak to IcedID
Summary: Unit 42 reports that the email-based malware campaign TA551, also known as Shathak, stopped pushing downloaders like Valak and Ursnif and from mid-July 2020 pushed IcedID directly through Word document macros. The campaign targeted English speakers from July 14, 2020, switched to Japanese-speaking victims from Oct. 27 to Nov. 20, 2020, and returned to English targets on Nov. 24, 2020, while changing its macro-generated URL patterns and IcedID file artifacts in October and November.
Bottom line: The lure is a spoofed email chain pulled from previously infected hosts, so the message arrives looking like a reply from someone the recipient knows. Unit 42 traced TA551 back to February 2019 and logged more than 50 days of indicators from mid-July to November 2020, a reminder that this actor keeps changing payloads and traffic patterns while the entry point stays the same.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026