TA577

Overview

TA577 is a financially motivated cybercrime threat actor tracked by Proofpoint since mid-2020, also identified by IBM X-Force as Hive0118. The group operates as an initial access broker — running high-volume phishing infrastructure to install malware loaders on enterprise endpoints, then selling or providing that access downstream to ransomware operators, most notably those connected to Black Basta. TA577 is considered one of the most capable and operationally consistent IABs in the current eCrime ecosystem, distinguished not by the sophistication of any single technique but by the speed and reliability with which it adapts to takedowns and detection cycles.

The group built its reputation as a primary Qbot (QakBot) affiliate — informally called the "letters" affiliate because its Qbot campaign identifiers used letter combinations like AA, BB, and TR, distinguishing it from the parallel "presidents" affiliate TA570 that used US president names. When the FBI and international law enforcement disrupted Qbot infrastructure in August 2023, TA577 moved faster than any other major Qbot affiliate to replace it — deploying DarkGate, IcedID, and Pikabot within weeks, and becoming one of the first actors observed distributing Latrodectus (a new loader likely written by the same developers as IcedID) in November 2023.

In February 2024, Proofpoint documented a capability shift that had never been previously observed from TA577: targeted NTLM hash theft campaigns using thread-hijacked emails with zipped HTML attachments that silently triggered SMB connections to attacker-controlled servers, capturing NTLMv2 challenge/response pairs. The campaigns sent tens of thousands of messages to hundreds of organizations globally over two consecutive days — with no malware payload, only credential capture. This evolution from pure malware distribution to active credential reconnaissance marked a significant expansion of the group's operational scope beyond its IAB role.

Payload Pivot Timeline

TA577's defining characteristic is the speed of its pivots after disruptions. The timeline below documents the group's payload evolution from Qbot through its current multi-loader and credential-theft operations.

Target Profile

TA577 is explicitly broad-sector and broad-geography in its targeting — Proofpoint describes the group as conducting "broad targeting across various industries and geographies." Unlike espionage APTs with sector-specific mandates, TA577's targeting is driven by volume and the downstream requirements of its ransomware customers rather than any intelligence collection priority.

• All sectors — opportunistic: TA577 has targeted organizations across financial services, healthcare, government, manufacturing, professional services, education, and technology. No sector exclusions are documented. The group's high-volume campaigns are designed to succeed through scale rather than precision.
• Global geography: Campaigns have targeted organizations in North America, Europe, the Asia-Pacific region, and globally. The February 2024 NTLM hash theft campaigns alone targeted hundreds of organizations across multiple countries simultaneously.
• Enterprise-scale targets: The downstream ransomware connection to Black Basta indicates a preference for large enterprise targets capable of paying substantial ransoms — TA577's access sales are most valuable when they lead to high-revenue ransomware negotiations. Small organizations compromised in bulk phishing are secondary to the enterprise access that drives IAB revenue.
• Email-reachable employees: TA577's initial access model is email-centric. Any organization whose employees receive external email and may open attachments or click links is in scope. Thread hijacking campaigns specifically target employees who receive replies to existing email chains — a scenario that reduces suspicion even for security-aware users.

Tactics, Techniques & Procedures

TA577's TTP set is defined by email delivery sophistication and rapid adaptation. The group invests in delivery mechanism quality — thread hijacking, container formats that bypass macro restrictions, and novel authentication coercion — rather than custom malware development.

mitre id	technique	description
T1566.001	Thread Hijacking — Reply-Chain Injection	TA577's signature delivery technique. Legitimate prior email threads — stolen from compromised mailboxes or obtained through other means — are used as the basis for malicious "reply" emails. The attacker's message appears in the recipient's inbox as a reply to an existing conversation they recognize, significantly increasing the likelihood that the attachment or link is opened. Thread hijacking was used in the 2024 NTLM campaigns, NTLM campaigns, and consistently throughout Pikabot and Latrodectus delivery.
T1204.002	Container Delivery — ZIP / HTML / OneNote / PDF	Following Microsoft's 2022 rollout of macro blocking for documents from the internet, TA577 pivoted to container-based delivery: malicious Office documents inside password-protected ZIP archives, HTML smuggling (embedding Base64-encoded payloads in HTML files that reconstruct and execute on the client), OneNote files with embedded malicious links, and PDF files with URL-based payload retrieval. The NTLM campaign delivered HTML files inside ZIP archives specifically to generate a local file — bypassing Outlook's July 2023 patch that would have blocked direct file URI links in email bodies.
T1187	NTLM Hash Capture — SMB Coercion	First observed February 26–27, 2024. Thread-hijacked emails deliver ZIP archives containing HTML files. Opening the HTML creates a local file that triggers a meta-refresh connecting to an attacker-controlled SMB server via a file scheme URI ending in .txt. Windows automatically attempts NTLM authentication against the SMB server, sending NTLMv2 challenge/response pairs. The attacker captures these using Impacket on the SMB server. Stolen NTLMv2 hashes can be cracked offline for plaintext passwords or used directly in pass-the-hash attacks. Disabling SMB guest access does not prevent capture — the system attempts authentication regardless. Blocking outbound SMB (ports 445/139) at the network perimeter is the primary mitigation.
T1059.001	Living-Off-the-Land — PowerShell / Rundll32	After initial access via phishing, TA577 uses LOLBins (Living-Off-the-Land Binaries) including PowerShell, CMD, and Rundll32 to execute malicious payloads downloaded by the loader. This reduces the reliance on custom executables and leverages trusted Windows components that may not trigger endpoint detection. Fast flux DNS and compromised WordPress sites serve payloads to compromised victims.
T1071	Fast Flux DNS / WordPress C2 Infrastructure	TA577 uses fast flux DNS — rapidly rotating IP addresses for C2 domains — to impede takedowns and domain-based blocking. Compromised WordPress sites serve as intermediate stages for payload hosting and C2 relay, leveraging the reputation of legitimate websites to bypass URL reputation filters on email gateways and proxies.
T1078	Credential-to-Persistence Chain	The February 2024 NTLM campaigns produced no malware delivery — their function appears to be reconnaissance: identifying valuable targets by capturing credentials and environment details (computer names, domain names, usernames) from the NTLMv2 authentication attempt. Will Dormann and other researchers suggested this may be used to assess which targets are worth targeting with subsequent ransomware-enabling malware deployment. The pass-the-hash capability of captured NTLMv2 hashes also enables direct lateral movement in environments without MFA.

Known Campaigns

Selected documented operations highlighting TA577's payload evolution and expanding capability set.

Tools & Malware

TA577 does not develop its own malware. It operates as a consumer and distributor of MaaS (malware-as-a-service) platforms, demonstrating rapid adoption of whatever loaders are most evasion-effective at a given moment.

• Qbot / QakBot (2020–2023): The group's primary payload for over three years. A modular banking trojan with reconnaissance, credential theft, C2, and anti-analysis capabilities. TA577 was one of two major Qbot affiliates — the other being TA570 ("presidents" affiliate). Disrupted by Operation Duck Hunt (FBI) in August 2023.
• Pikabot (2023–present): TA577's most sustained post-Qbot payload. A modular loader with anti-analysis, C2, and payload execution capabilities. TA577 has been observed delivering Pikabot via a variety of continuously evolving attack chains — OneNote attachments, HTML smuggling, disk images, and others — reflecting the group's commitment to adapting delivery mechanisms as each is detected and blocked.
• Latrodectus (Nov 2023 — first distributor): A new downloader likely developed by the IcedID authors, first distributed by TA577 in November 2023. IcedID-related backend infrastructure and jumpboxes confirmed during Proofpoint and Team Cymru analysis. Sandbox evasion via process count check, 64-bit verification, and MAC address validation. TA577 used Latrodectus briefly before reverting to Pikabot; TA578 subsequently adopted it as a primary payload.
• DarkGate (Sep 2023): A MaaS loader offered on cybercrime forums, adopted by TA577 as an immediate Qbot replacement. Built-in defense evasion, C2, and persistence. TA577 was among the first actors to distribute DarkGate post-Qbot disruption.
• IcedID (during 2023 transition): Used alongside DarkGate and Pikabot during the post-Qbot pivot period. TA577's use of IcedID — and its distribution of Latrodectus (likely from IcedID developers) — suggests an established relationship with the IcedID operator network.
• Impacket (NTLM campaigns): An open-source Python toolkit used on attacker-controlled SMB servers to capture NTLMv2 challenge/response pairs from victims' automatic NTLM authentication attempts. The presence of Impacket on TA577's SMB servers — a non-standard configuration on legitimate servers — served as an IOC in Proofpoint's 2024 analysis.
• Historical payloads — SystemBC, SmokeLoader, Ursnif, Cobalt Strike: Distributed alongside Qbot during the pre-2023 period, providing multiple post-access capability paths for downstream ransomware operators who purchased TA577 access.

Indicators of Compromise

TA577 rotates delivery infrastructure rapidly. Behavioral detection of email delivery patterns and outbound connection behaviors is more durable than specific domain or hash IOCs.

Mitigation & Defense

TA577's primary attack surface is email — blocking or detecting malicious email delivery is significantly more effective than attempting post-execution containment of the loaders it distributes.

• Block outbound SMB at network perimeter: Ports 445 and 139 should not be permitted to reach external internet addresses from internal workstations. This is the primary mitigation against TA577's NTLM hash theft campaign — it prevents the automatic SMB authentication that delivers NTLMv2 hashes to the attacker's server. This control also benefits against a broad class of NTLM coercion attacks beyond TA577's specific technique.
• Email gateway controls for ZIP-containing HTML: Filter or sandbox ZIP archives containing HTML files from external senders. HTML files inside ZIPs are a delivery mechanism specifically designed to bypass both Outlook's file URI patch (July 2023) and email scanners that inspect only top-level attachments. An email gateway that recursively inspects archive contents will detect this delivery pattern.
• Thread hijacking awareness training: TA577's thread hijacking exploits the trust employees place in replies to recognized email conversations. Security awareness training should explicitly address that a reply from a familiar address on a known thread does not guarantee legitimacy — particularly if the reply contains an unexpected attachment or link. Thread-hijacked phishing remains effective precisely because it bypasses the standard "did I expect this email?" heuristic.
• Patch Outlook for file URI blocking: Ensure all Outlook clients are patched with the July 2023 security update (CVE-2023-23397 mitigation context) that blocks direct file scheme URI links in email bodies. This alone does not prevent TA577's ZIP-wrapped HTML technique — but it eliminates the simpler direct URI delivery variant that other actors still use.
• Windows 11 NTLM-over-SMB blocking: Windows 11 introduced a built-in feature to block NTLM authentication over SMB — enabling this provides an endpoint-level control supplementing the perimeter SMB block. Organizations that cannot enforce perimeter SMB blocking (e.g., due to legitimate external SMB requirements) should prioritize enabling this Windows 11 control.
• Implement or enforce MFA on all domain accounts: NTLM hashes captured by TA577 can be used in pass-the-hash attacks only where MFA is not enforced. For accounts where NTLM pass-the-hash lateral movement is a realistic risk — particularly administrator accounts — MFA enrollment is essential. Stolen NTLMv2 hashes are also crackable offline if the underlying password is weak; enforcing strong password policies reduces the cracking risk for captured hashes.
• Configure Group Policy to restrict outgoing NTLM traffic: The Windows Group Policy setting "Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers" can be set to deny NTLM authentication to external servers entirely, or to an allowlist of known legitimate servers. Setting this to "Deny all" prevents automatic NTLM authentication to attacker-controlled SMB servers without requiring perimeter firewall changes. Proofpoint recommends testing this in audit mode before enforcement, as it can cause authentication failures against legitimate servers.
• Monitor for anomalous Pikabot and Latrodectus IoCs: Consult current Proofpoint and Team Cymru threat intelligence feeds for active Pikabot and Latrodectus C2 infrastructure. Both loaders use distinctive C2 communication patterns (Latrodectus uses HTTPS with specific TLS characteristics; Pikabot uses RC4-encrypted C2 over HTTPS). EDR vendors publish detection rules for both families that should be kept current given the active update cycles documented in TA577 campaigns.

Sources & Further Reading

Attribution and references used to build this profile.

• Proofpoint — TA577's Unusual Attack Chain Leads to NTLM Data Theft (2024)
• BleepingComputer — Hackers Steal Windows NTLM Authentication Hashes in Phishing Attacks (2024)
• Proofpoint — Latrodectus: Spider Bytes for Ice (Latrodectus analysis, 2024)
• Help Net Security — New Latrodectus Loader Steps in for Qbot (2024)
• Brandefense — TA577 / Hive0118: The Evolving Phishing Specialist Behind Modern Malware Campaigns (2026)
• Red Canary — Qbot Threat Detection Report (includes TA577 post-pivot analysis)
• The Hacker News — Warning: Thread Hijacking Attack Targets IT Networks, Stealing NTLM Hashes (2024)
• Darktrace — Hashing Out: TA577 and Detection of NTLM Hash Theft (2024)