TA2541

· ATT&CK GroupG1018

Techniques

Software

Tactics

Aliases

Description

TA2541 is a cybercriminal group that has been targeting the aviation, aerospace, transportation, manufacturing, and defense industries since at least 2017. TA2541 campaigns are typically high volume and involve the use of commodity remote access tools obfuscated by crypters and themes related to aviation, transportation, and travel.(Citation: Proofpoint TA2541 February 2022)(Citation: Cisco Operation Layover September 2021)

Tactic Coverage

stealth (7)execution (6)resource development (5)privilege escalation (4)discovery (3)command and control (3)persistence (2)initial access (2)defense impairment (1)

Techniques Used (28)

T1016.001Internet Connection Discovery

discovery

T1027.002Software Packing

stealth

T1027.013Encrypted/Encoded File

stealth

T1027.015Compression

stealth

T1036.005Match Legitimate Resource Name or Location

stealth

Registration Required

Create a free account to access full Threat Actor Techniques

Showing 5 of 28 results

✓ Personal dashboard✓ Track 1 vendor/product✓ 1 keyword alert✓ Weekly digest✓ 1 CSV export/month

Already have an account? Sign in →

Software Used (9)

S0331Agent Teslamalware S1087AsyncRATtool S0434Imminent Monitortool S0198NETWIREmalware S0379Revenge RATmalware S1086Snip3malware S0670WarzoneRATmalware S0283jRAT

References (3)

https://attack.mitre.org/groups/G1018 https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight https://blog.talosintelligence.com/operation-layover-how-we-tracked-attack/