TA577 Threat Actor Profile: hijacked email threads, loaders and NTLM hash theft

TA577 is an initial access broker that replies inside your real email conversations, and in 2024 it showed it could steal Windows credential material with nothing more than a zipped HTML file. MITRE ATT&CK tracks it as G1037 and describes it as an initial access broker that has distributed QakBot and Pikabot and was among the first groups seen distributing Latrodectus in 2023. Proofpoint, which named the group and supplies almost all of the public reporting, has linked its campaigns to follow-on ransomware including Black Basta. This profile is for email security teams, SOC analysts and Windows infrastructure engineers. It covers who the group is, how its campaigns have changed after each takedown, the ATT&CK techniques recorded against it, and the controls that blunt it, especially the outbound SMB and NTLM settings that stop its hash theft technique. For the loaders themselves, see the Latrodectus and Bumblebee Loaders Guide and the QakBot Malware Guide.

Key takeaways

• The email looks like a reply because it is one. ATT&CK records TA577 sending thread-hijacked messages from compromised email accounts, so familiarity of sender and subject proves nothing.
• The payload changes, the business does not. QakBot until its 2023 disruption, then Pikabot and, briefly in November 2023, Latrodectus: the constant is selling access that ends in ransomware.
• Credentials can be the payload. In February 2024 Proofpoint saw tens of thousands of messages whose HTML attachments made Windows connect to an attacker SMB server and send NTLMv2 challenge and response data.
• Outbound SMB is the cheapest fix. Proofpoint says organisations should block outbound SMB to prevent this hash theft technique; disabling SMB guest access does not help.
• Takedowns slow it, they do not end it. Operation Duck Hunt disrupted QakBot in August 2023 and Operation Endgame hit Pikabot infrastructure in May 2024, yet the group switched loaders each time.

Who they are

TA577 is Proofpoint's designation, and ATT&CK lists no other aliases for G1037. Proofpoint calls it a prominent cybercrime actor, one of the major QakBot affiliates before that botnet's disruption, and an initial access broker whose campaigns it has linked to Black Basta ransomware. Proofpoint notes that it normally sees TA577 delivering malware rather than stealing credentials, which is why the 2024 NTLM campaign stood out. Treat TA577 as one supplier in a wider cybercrime market: the ransomware that follows is run by its customers. See the Initial Access Brokers Guide.

Malware associated with the group

Targeting and motivation

• Motivation: financial. The group sells or uses access that leads to ransomware and other monetisation.
• Reach: broad and global. The February 2024 hash theft wave reached hundreds of organisations with tens of thousands of messages (Proofpoint).
• Selection: opportunistic at the email stage, with each message tuned to look like part of a conversation the recipient already had. Proofpoint saw each HTML file customised per recipient and each ZIP with a unique hash, which defeats simple hash blocking.
• Who should care: any organisation using email at scale, and especially those whose partners or customers have had mailboxes compromised, because the hijacked thread may come from them.

Notable activity

For how these operations work and what they achieve, see the Cybercrime Law Enforcement Takedowns Guide.

Tactics and techniques (MITRE ATT&CK)

The first seven rows are the ATT&CK v20 techniques recorded against G1037. The last two map Proofpoint's description of the February 2024 campaign (marked NHIMG mapping).

See MITRE ATT&CK T1187 Forced Authentication and T1059 Command and Scripting Interpreter Defensive Guide.

How they abuse identities and credentials

• Compromised mailboxes as infrastructure: every hijacked thread starts with someone's email account. Your users' mailboxes are the next sender if they are compromised, so phishing-resistant MFA, legacy authentication blocks and alerts on unusual mailbox access protect other organisations as well as yours.
• NTLM responses as loot: Proofpoint says the 2024 wave captured NTLMv2 challenge and response pairs plus computer, domain and user names in clear text. A weak password can be cracked offline; Proofpoint also notes possible pass-the-hash use. Assume any user who opened the attachment on a network that allowed outbound SMB has exposed credential material.
• Attacker tooling clues: Proofpoint judged the attacker SMB servers were likely running the open-source Impacket toolkit, based on its default server challenge and GUID, which Emerging Threats signatures can detect.
• Domain identities after the loader: once QakBot or Pikabot runs, the value to buyers is the user's domain access. Keep privileged accounts off email and browsing hosts.

For the protocol background, see the NTLM Relay Guide, the NTLM Deprecation and Elimination Guide and the Pass-the-Hash and Pass-the-Ticket Guide.

Detection and defence

What to monitor

Phased response plan

1. Block outbound SMB: deny TCP 445 (and 139) from all internal networks to the internet at the perimeter and on host firewalls. Check first in logs for legitimate external SMB use, which is rare.
2. Restrict outgoing NTLM: set the Group Policy "Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers" to audit, review the NTLM operational log, add needed exceptions, then deny. Rollback is a policy change. Track the longer path to removing NTLM in the deprecation guide.
3. Harden the mail gateway: block or quarantine ISO, LNK and script files in archives, sandbox HTML attachments and rewrite links. Keep Outlook patched: Proofpoint notes clients patched since July 2023 were not exposed to a file URI placed directly in the message body.
4. Neutralise scripts: make JavaScript and similar files open in Notepad by default and block script hosts for standard users where possible, piloting with one department.
5. Respond to openings as credential events: for users who opened the attachment, reset passwords, review sign-ins and look for pass-the-hash patterns from their account.
6. Protect the senders: phishing-resistant MFA on mailboxes and alerts on new inbox rules or bulk replies reduce your chance of becoming a TA577 relay.

Decision guidance

• Small organisations: blocking outbound SMB at the router, keeping Outlook updated and changing the script file handler covers most of the documented chain at little cost.
• Large organisations: add outgoing NTLM restrictions in stages, HTML and archive sandboxing, loader-focused detection content and a playbook that treats a loader alert as a ransomware precursor.
• Blocking versus user friction: blocking ISO and script attachments outright rarely affects business mail; review a month of gateway logs first and allow named exceptions only.

Metrics

• Outbound SMB connections to the internet per week (target zero).
• Percentage of hosts with outgoing NTLM restricted to an exception list.
• Percentage of mailboxes protected by phishing-resistant MFA.
• Number of ISO, LNK or script attachments delivered to inboxes per month.
• Median time from a loader alert to host isolation and credential reset.

Framework mapping

Common failure patterns

• Allowing outbound SMB by default: one opened HTML file then sends credential material straight to the internet.
• Trusting familiar threads: users and filters relax for replies, which is exactly what thread hijacking exploits.
• Blocking by hash: unique ZIP hashes and per-recipient HTML files make hash lists useless against these waves.
• Treating a disrupted botnet as a solved problem: TA577 moved from QakBot to Pikabot and Latrodectus within months.
• Closing a hash theft alert because no malware ran: no malware was delivered in the February 2024 campaign; the credential exposure was the outcome.

Practitioner checklist

• Block outbound TCP 445 and 139 to the internet on perimeter and host firewalls.
• Audit, then restrict, outgoing NTLM to remote servers.
• Quarantine ISO, LNK and script files in archives; sandbox HTML attachments.
• Keep Outlook and Windows patched.
• Make script files open in Notepad by default.
• Alert on wscript.exe spawning cmd.exe or curl, and on ISO to LNK to DLL chains.
• Reset credentials for users who opened hash theft attachments.
• Enforce phishing-resistant MFA on mailboxes and alert on unusual reply activity.

Standards and references

• MITRE ATT&CK: TA577 (G1037)
• Proofpoint: TA577's unusual attack chain leads to NTLM data theft
• Proofpoint: Latrodectus, this spider bytes like ice
• US Department of Justice: Qakbot malware disrupted in international cyber takedown
• Europol: Largest ever operation against botnets hits dropper malware ecosystem
• MITRE ATT&CK: T1187 Forced Authentication
• NIST: SP 800-53 Rev. 5

Related NHI Mgmt Group resources: QakBot Malware Guide · Latrodectus and Bumblebee Loaders Guide · Black Basta Threat Actor Profile · NTLM Relay Guide · Mustard Tempest Threat Actor Profile