Two sides of the same coin
April 21, 2025, 12:45 p.m.
Description
This intelligence report analyzes the similarities between two previously separate APT groups, Team46 and TaxOff, concluding they are likely the same entity. The analysis covers their shared tactics, techniques, and procedures, including similar PowerShell commands, loader functionality, and infrastructure patterns. Key findings include the use of zero-day exploits, complex malware development, and long-term persistence strategies. The report details the groups' use of multi-layered encryption in their loaders, custom obfuscation techniques, and various malware tools like Trinper backdoor and Cobalt Strike. The combined group, now referred to as Team46, demonstrates sophisticated capabilities in targeted attacks against protected infrastructures.
Tags
Date
- Created: April 18, 2025, 9:45 p.m.
- Published: April 18, 2025, 9:45 p.m.
- Modified: April 21, 2025, 12:45 p.m.