- Category
- Targeted, sponsor unknown · Targeted intrusions with no sponsor attributed.
- Origin
- Unknown
- Motivation
- Information theft and espionage
- Seen
- 2017–2026
- Status
- Active
- ATT&CK
- G1018 · 28 techniques
- Sources
- 9 sources carry it
- Identifier
- GINC-APT-0098 · ta2541
What it is
TA2541 is a cybercriminal group that has been targeting the aviation, aerospace, transportation, manufacturing, and defense industries since at least 2017. TA2541 campaigns are typically high volume and involve the use of commodity remote access tools obfuscated by crypters and themes related to aviation, transportation, and travel.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Aviator Spider
Targets
- Sectors
- Aerospace, Aviation, Defense, Transportation
Tools
The tools and malware families the sources tie to it.
- Agent Tesla
- AsyncRAT
- Ave Maria
- Cyber Eye RAT
- CyberGate
- DarkRAT
- H-Worm
- Imminent Monitor
- Imminent Monitor RAT
- Luminosity RAT
- NETWIRE
- NetWire RC
- Parallax RAT
- Remote Utilities
- RemoteCMD
- RemotePC
- Revenge RAT
- RevengeRAT
- SPACESHIP
- Snip3
- Trojan.Karagany
- Trojan.Mebromi
- WarzoneRAT
- jRAT
- njRAT
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de