TA576 — APT Profile

TA576 conducts cryptocurrency fraud and BEC-style attacks against financial and cryptocurrency organizations.

Tools & malware

Mshta Living-off-the-land binary
NetWire Remote Access Trojan
Parallax RAT Remote Access Trojan
SyncAppvPublishingServer.vbs (LOLBAS) Living-off-the-land binary

Vendor research

Security Brief: 'Tis the Season for Tax Hax Proofpoint
Security Brief: Threat Actors Pair Tax-Themed Lures With COVID-19, Healthcare Themes Proofpoint

Read the full analysis on IntelFusions