THREAT ACTOR PROFILE
![](data:image/svg+xml,<svg display="block" role="presentation" viewBox="0 0 512 512" xmlns="http://www.w3.org/2000/svg"><path d="M 36.693 100.352 C 27.477 100.352 20.309 99.897 15.189 98.987 C 10.183 98.077 6.542 97.053 4.267 95.915 C 2.105 94.777 0.683 93.981 0 93.526 L 8.363 74.923 C 10.069 75.151 13.028 75.435 17.237 75.776 C 21.561 76.004 27.591 76.231 35.328 76.459 C 43.178 76.687 53.134 76.8 65.194 76.8 C 69.973 76.8 73.102 76.004 74.581 74.411 C 76.06 72.704 76.8 70.031 76.8 66.39 L 76.8 65.366 C 76.8 62.521 75.946 60.359 74.24 58.88 C 72.647 57.401 69.575 56.662 65.024 56.662 L 20.48 56.662 L 6.827 58.368 L 6.827 0 L 89.258 0 C 94.947 0 98.986 0.228 101.376 0.683 C 103.765 1.138 104.96 1.593 104.96 2.048 L 99.84 23.211 L 39.765 23.211 L 39.765 38.059 C 41.017 37.831 43.065 37.661 45.909 37.547 C 48.867 37.319 52.224 37.149 55.978 37.035 C 59.733 36.807 63.431 36.694 67.072 36.694 L 75.434 36.694 C 88.177 36.694 97.109 39.026 102.229 43.691 C 107.349 48.356 109.909 55.751 109.909 65.878 L 109.909 69.803 C 109.909 73.785 109.454 77.597 108.544 81.238 C 107.633 84.879 105.984 88.178 103.594 91.136 C 101.205 93.981 97.735 96.256 93.184 97.963 C 88.633 99.556 82.716 100.352 75.434 100.352 Z M 148.714 100.352 L 153.493 90.112 L 199.232 25.259 L 199.232 23.552 L 128.746 23.552 L 128.746 0 L 237.973 0 L 237.973 16.555 L 184.896 100.352 Z M 271.541 100.352 L 276.32 90.112 L 322.058 25.259 L 322.058 23.552 L 251.573 23.552 L 251.573 0 L 360.8 0 L 360.8 16.555 L 307.722 100.352 Z" fill="rgb(37, 101, 195)" height="100.35200000000003px" id="KFtCanxVP" transform="translate(73.195 270.094)" width="360.8003032226563px"/><path d="M 38.18 86.162 L 38.034 14.043 L 0 14.043 L 0 0 L 95.671 0 L 95.671 14.043 L 57.49 14.043 L 57.49 86.162 Z M 88.388 86.162 L 131.25 0.146 L 160.068 0.146 L 202.784 86.162 L 180.256 86.162 L 171.625 67.584 L 119.255 67.584 L 109.746 86.162 Z M 124.521 53.248 L 166.212 53.248 L 146.171 13.312 L 144.708 13.312 Z" fill="rgb(37, 101, 195)" height="86.162px" id="UHDd4N85m" transform="translate(156.148 128.117)" width="202.78400048828127px"/></svg>)
TA577 is a Russia-linked initial access broker active since around 2020 that runs high-volume email campaigns to deliver loaders and backdoors. It has distributed QakBot, IcedID, Pikabot and others, handing access to ransomware operators like Black Basta, and it has used thread hijacking and zipped HTML attachments to steal NTLM authentication data.
Country:
Russia
eCrime / Access broker
First seen
2020
Latest IOC
-
TABLE OF CONTENTS
NAMES AND ALIASES
-
-
-
GROUP PROFILE
Facts:
Initial Access
Russian Federation · GRU
Initial Access
Russian Federation · GRU
Initial Access
Russian Federation · GRU
Initial Access
Russian Federation · GRU
Victims reported in our records and posts:
-
-
-
-
ATTACK LIFECYCLE
Initial Access
Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.
Initial Access
Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.
Initial Access
Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.
Initial Access
Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.
Initial Access
Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.
MALWARE AND TOOLING
Initial Access
Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.
Initial Access
Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.
Initial Access
Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.
Initial Access
Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.
CVES EXPLOITED
Latest IOCs
We currently track - IP indicators, - hosts, and - SHA256 hashes for Akira across - intelligence posts, with the most recent indicator dated -. The sample below is limited to indicators from the latest posts. It is not the full set.
NOTABLE CAMPAIGNS
PixyNetLoader tracking
A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.
PixyNetLoader tracking
A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.
PixyNetLoader tracking
A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.
PixyNetLoader tracking
A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.