势不可挡：TA584 创新初始准入.pdf

1、Selena Larson,ProofpointCant Stop,Wont Stop:TA584 Innovates Initial Access2 2025 Proofpoint,IncTA584 is one of the most prominent cybercriminal threat actors tracked by my team.In 2025,the actor demonstrated multiple attack chain changes:expanded global targeting;ClickFixsocial engineering;and new m

2、alware,Tsundere Bot.TA584s activity is unique in the cybercrime landscape and shows how static detections alone are not reliable for constantly innovating threat actors.TA584 is kind of a big deal.TL;DRTA584(noun)(tee-ay-five-eight-four):1:cybercrime actor,initial access via email2:rapidly changing

3、TTPs align with targeting objectives3:really needs to chillTA584Background014 2025 Proofpoint,IncMajor cybercrime power playerWho is TA584?Prominent initial access broker targeting organizations globally TA584 uses a variety of tactics,techniques,and procedures(TTPs).Delivery methods included macro-

4、enabled Excel documents,URLs with aggressive filtering,use of various traffic distribution services(TDS),and geo-fenced landing pages.TTPs significantly shifted in 2025,and continues into this year.5 2025 Proofpoint,IncMajor cybercrime power playerOG TA584 Excel documents,URLs,countdown landing page

5、s Always used filtering and aggressive social engineering Old malware:Ursnif,LDR4,Xeno RAT,Cobalt Strike Fewer brands used:recruiting,documents,payments,business relevant content6 2025 Proofpoint,IncMajor cybercrime power playerOG TA5847 2025 Proofpoint,IncMoar campaignsWhats new From predictable pa

6、tterns(2020 2024)to high volume campaign churn(2025-now)The number of monthly campaigns tripled from March to December 2025.0510152025Mar-25Apr-25May-25Jun-25Jul-25Aug-25Sep-25Oct-25Nov-25Dec-25CampaignDateTA584 Campaign Count,20258 2025 Proofpoint,IncMoar brands|new social engineeringWhats new Broa