TA2536

TA2536 is a threat actor observed by Proofpoint in phishing campaigns. The provided content describes TA2536 as one of multiple actors that conducted phishing campaigns delivering Stealerium, and as one of the threat actors that has used the DTPacker malware packer/downloader since at least 2020. Proofpoint observed DTPacker associated with dozens of campaigns and multiple threat actors, including TA2536 and TA2715, and noted that the tool has been used by both APT and cybercrime actors. In these campaigns, email was a common initial infection vector, with malicious attachments leading to DTPacker execution and subsequent delivery of payloads such as information stealers and RATs. DTPacker has been used to distribute malware including Agent Tesla, Ave Maria (Warzone RAT), AsyncRAT, FormBook, and Snake Keylogger, and employs obfuscation techniques such as custom XOR routines, character code substitution, string obfuscation, junk Unicode characters, base64 encoding, and fixed decoding keys such as 'trump2020' and 'Trump2026'. The content does not provide a country attribution or additional confirmed aliases for TA2536 beyond the name itself.