Team46 and TaxOff: Two Sides of the Same Coin

Description

This intelligence report reveals that Team46 and TaxOff are likely the same APT group, now referred to as Team46. The analysis compares their attack methods, including the use of similar PowerShell commands, URL patterns, and loader functionality. Both groups utilized zero-day exploits and developed sophisticated malware, indicating a long-term strategy for maintaining persistence in compromised systems. The report details the encryption layers and decryption process of the Trinper backdoor, as well as the use of auxiliary tools for system reconnaissance. The unified group's infrastructure mimics legitimate services, and their techniques include phishing emails, DLL hijacking, and the use of Cobalt Strike beacons.