Researchers Expose TA585’s MonsterV2 Malware Capabilities and Attack Chain

Cybersecurity researchers have spotlighted an undocumented threat actor named TA585, observed delivering MonsterV2, an off-the-shelf malware, through phishing campaigns. According to Proofpoint Threat Research Team, TA585 operates its own attack chain with multiple delivery techniques, rather than outsourcing distribution, and MonsterV2 is described as a remote access trojan, stealer, and loader first seen on criminal forums in February 2025.

MonsterV2, also known as Aurotun Stealer, has been distributed via CastleLoader in prior campaigns and is sold by a Russian-speaking actor for $800 per month for the “Standard” edition or $2,000 per month for the “Enterprise” version, with the stealer notably avoiding CIS countries.

Phishing lures themed around the IRS direct users to a PDF that links to a web page employing ClickFix to trigger infection via a Windows Run dialog or PowerShell, and later waves in April 2025 used malicious JavaScript injections on legitimate sites to deliver a PowerShell payload.

MonsterV2 is packed with SonicCrypt to evade detection, decrypts its configuration to contact its C2 server, and can perform functions such as HVNC, taking screenshots, keylogging, and downloading next-stage payloads, while TA585’s activity clusters—centred on web injects and bogus GitHub alerts—have been linked to CoreSecThree, according to PRODAFT.