TA2541
- ID
- G1018
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
TA2541 is a cybercriminal group that has been targeting the aviation, aerospace, transportation, manufacturing, and defense industries since at least 2017. TA2541 campaigns are typically high volume and involve the use of commodity remote access tools obfuscated by crypters and themes related to aviation, transportation, and travel.[1][2]
Techniques used (28)
- T1016.001 Internet Connection Discovery
- T1027.002 Software Packing
- T1027.013 Encrypted/Encoded File
- T1027.015 Compression
- T1036.005 Match Legitimate Resource Name or Location
- T1047 Windows Management Instrumentation
- T1053.005 Scheduled Task
- T1055 Process Injection
- T1055.012 Process Hollowing
- T1059.001 PowerShell
- T1059.005 Visual Basic
- T1082 System Information Discovery
- T1105 Ingress Tool Transfer
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1218.005 Mshta
- T1518.001 Security Software Discovery
- T1547.001 Registry Run Keys / Startup Folder
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1568 Dynamic Resolution
- T1573.002 Asymmetric Cryptography
- T1583.001 Domains
- T1583.006 Web Services
- T1588.001 Malware
- T1588.002 Tool
- T1608.001 Upload Malware
- T1685 Disable or Modify Tools
Software used (9)
- S0198 NETWIRE
- S0283 jRAT
- S0331 Agent Tesla
- S0379 Revenge RAT
- S0385 njRAT
- S0434 Imminent Monitor
- S0670 WarzoneRAT
- S1086 Snip3
- S1087 AsyncRAT