APT / THREAT GROUP

TA575

aliases

Last seen:Mar 17, 2026

Intelligence Profile

TA575 is a Dridex affiliate tracked by Proofpoint since late 2020. This group distributes malware such as Dridex, Qakbot, and WastedLocker via malicious URLs, Office attachments, and password-protected files. On average, TA575 distributes almost 4,000 messages per campaign impacting hundreds of organizations.

Threat Analysis

TA575 is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://blogs.blackberry.com/en/2021/08/blackberry-prevents-threat-actor-group-ta575-and-dridex-malware

→https://www.proofpoint.com/us/blog/threat-insight/ta575-uses-squid-game-lures-distribute-dridex-malware

→https://www.zdnet.com/article/ta575-criminal-group-using-squid-game-lures-for-dridex-malware/

→https://www.proofpoint.com/us/blog/threat-insight/first-step-initial-access-leads-ransomware

Quick Facts

TypeAPT / Threat Group

Aliases1

SourceMalpedia

Also Known As

TA575

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search TA575