Excerpt
After months of inactivity, hacking group TA505's Get2 Loader has sprung back into operation, possibly signaling that the group is ready for a new round of malicious activity.
On December 14, 2020, the Get2 loader had resurfaced with new download and execute configuration parameters named "LD" and "ED." Intel 471 last observed the loader in operation on September 14, 2020.
The "LD" parameter reflectively loads a downloaded dynamic-link library (DLL) file into the address space of the current process and calls its entry point. The "ED" parameter copies the DLL into executable memory and invokes the entry point directly. The preexisting "RD" param…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Intel 471 on intel471.com.
Mentioned in the excerpt
More from Intel 4711
- Here’s how to guard your enterprise against ShinyHuntersIntel 471 · Published 22 Oct 2025
On the same topics
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun