Detecting TA551 domains

Executive Summary

TA551 are an active threat group known for distributing high volumes of malicious spam (malspam) that deliver different families of malware.

Using a TA551 campaign delivering Ursnif as an example, we describe a typical infection chain, and explore potential detection opportunities, such as monitoring process chains or file masquerading. We propose a different detection method based on identifying patterns in the domains registered TA551 domains, and share our evaluation of over 500 TA551 domains from the last year.

Our domain detection method identified 207 potential newly-registered TA551 domains over a four month period.

Who are TA551?

TA551, also known as…