- Category
- Targeted, sponsor unknown · Targeted intrusions with no sponsor attributed.
- Origin
- Unknown
- Seen
- to 2026
- Status
- Active
- ATT&CK
- G1038 · 4 techniques
- Sources
- 6 sources carry it
- Identifier
- GINC-APT-0352 · ta578
What it is
TA578 is a threat actor that has used contact forms and email to initiate communications with victims and to distribute malware including Latrodectus, IcedID, and Bumblebee.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Honey Spider
Tools
The tools and malware families the sources tie to it.
- Archelaus Beta
- Bumblebee
- Cobalt Strike
- IcedID
- Latrodectus
Sources
- MITRE ATT&CK attack.mitre.org
- Malpedia malpedia.caad.fkie.fraunhofer.de