🇷🇺

GOLD CABIN

APT Group 4 zero-day CVEs ETDA ✓

Also Known As 5 names

ATK236 G0127 Monster Libra Shakthak TA551

Target Countries 1

Countries highlighted in red

United States

Sectors Targeted

Grantmaking and Giving Services 8132

Details

Origin 🇷🇺 RU

Last Updated 16 Apr 2025

Malware Families 12

dreambot

snifula

icyheart

EMOTET

ldr4

bee

icedid_downloader

saigon

vawtrak

Sliver Implant

mykings_spreader

gozi

MITRE ATT&CK 52

T1001 T1002 T1003 T1012 T1021 T1027 T1027.003 T1027.010 T1033 T1036 T1040 T1043 T1055 T1059 T1059.003 T1071 T1071.001 T1073 T1074 T1082 T1090 T1095 T1102 T1104 T1105 T1107 T1113 T1132 T1132.001 T1137.001 T1140 T1204 T1204.001 T1204.002 T1218 T1218.005 T1218.010 T1218.011 T1498 T1546 T1547 T1548 T1550 T1566 T1566.001 T1568 T1568.002 T1589 T1589.002 T1592 T1598.002 TA0037

Related Zero-Days 4

CVE-2021-26855 CVE-2021-26857 CVE-2021-26858 CVE-2021-27065

Known Names 5 entries

TA551 Proofpoint

Gold Cabin SecureWorks

Shathak ?

Monster Libra Palo Alto

G0127 MITRE

Description

(Palo Alto) TA551 (also known as Shathak) is an email-based malware distribution campaign that often targets English-speaking victims. The campaign discussed in this blog has targeted German, Italian and Japanese speakers. TA551 has historically pushed different families of information-stealing malware like Ursnif and Valak. After mid-July 2020, this campaign has exclusively pushed IcedID malware, another information stealer.

Tools Used 4

BokBot Gozi Sliver Valak

Operations 2

2021-10 TA551 Uses ‘SLIVER’ Red Team Tool in New Activity https://www.proofpoint.com/us/blog/security-briefs/ta551-uses-sliver-red-team-tool-new-activity

2021-01 From IcedID to Domain Compromise https://www.cybereason.com/blog/threat-analysis-from-icedid-to-domain-compromise

Reports & References 3

https://unit42.paloaltonetworks.com/ta551-shathak-icedid/ https://unit42.paloaltonetworks.com/valak-evolution/ https://github.com/pan-unit42/iocs/tree/master/TA551

ETDA Profile

TA551, Shathak

Origin

Russia

First Seen 2016

Motivation

Financial gain

MITRE ATT&CK Groups

https://attack.mitre.org/groups/G0127/

View on ETDA APT Groups ↗