FORENSIA

THREAT_ACTOR · G0127

TA551

Also known as: TA551, GOLD CABIN, Shathak

Profile

TA551 is a financially-motivated threat group that has been active since at least 2018. The group has primarily targeted English, German, Italian, and Japanese speakers through email-based malware distribution campaigns.

MITRE ATT&CK ↗

Techniques

14 ATT&CK techniques attributed to this actor.

T1027.003 SteganographyT1027.010 Command ObfuscationT1036 MasqueradingT1059.003 Windows Command ShellT1071.001 Web ProtocolsT1105 Ingress Tool TransferT1132.001 Standard EncodingT1204.002 Malicious FileT1218.005 MshtaT1218.010 Regsvr32T1218.011 Rundll32T1566.001 Spearphishing AttachmentT1568.002 Domain Generation AlgorithmsT1589.002 Email Addresses

Software

5 malware/tools attributed to this actor.

UrsnifValakIcedIDSliverQakBot

Related corpus activity

10,044 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to TA551.

IndicatorTypeFamilySevSrc
cve-2023-44976cveransomware852
cve-2026-1969cve—851
cve-2025-68670cve—852
cve-2026-3102cve—853
cve-2025-34117cve—851
cve-2021-29441cve—851
cve-2026-22584cve—852
cve-2025-11837cve—852
cve-2025-34054cve—854
cve-2014-2321cve—851
cve-2020-22653cve—852
cve-2025-2492cve—852
cve-2017-18377cve—851
cve-2021-25646cve—851
cve-2025-66478cve—852
cve-2025-0921cve—852
cve-2021-27076cve—851
cve-2013-3307cve—852
cve-2016-5681cve—852
cve-2016-15047cve—854
cve-2024-1781cve—851
cve-2018-8007cve—851
cve-2021-4045cve—851
cve-2020-17456cve—851
cve-2022-47945cve—851
cve-2020-22658cve—852
cve-2025-23304cve—852
cve-2026-4368cveransomware851
cve-2013-7471cve—851
cve-2026-0740cve—851

Showing the top 30 by severity of 10,044.