TA582

TA582 is a post-exploitation and malware delivery operator tracked by Recorded Future, with Mandiant tracking the same activity as UNC4108. The reporting places TA582 downstream of the SocGholish fake browser update ecosystem and as a user of the TAG-124/KongTuke traffic distribution system. TA582 has been identified among multiple threat actors incorporating TAG-124 into initial infection chains, alongside operators such as TA866/Asylum Ambuscade, SocGholish, D3F@CK Loader, Rhysida, and Interlock. TA582 is associated in the provided reporting with GhostWeaver, a non-commodity, fileless in-memory PowerShell RAT that communicates over TLS on TCP port 25658 using a custom protocol with GZip-compressed JSON. GhostWeaver uses four DGAs across the kill chain, hardcoded public DNS resolvers to bypass enterprise DNS controls, and a plugin architecture supporting browser, Outlook, and cryptocurrency wallet credential theft, web injection via MITM proxy, and redeployment of the initial loader. Researchers observed active GhostWeaver C2 nodes accepting beacons without challenge-response and rapidly pushing a PowerShell persistence framework. The infection chain described for TA582 involves compromised WordPress sites and fake browser update lures associated with SocGholish/ParrotTDS and TAG-124/KongTuke. Delivery uses MintsLoader to profile victims and evade sandbox analysis by scoring host characteristics such as VM indicators, GPU type, and CPU cache levels; payloads may be withheld from sandbox-like environments or replaced with decoys. GhostWeaver persistence includes AV-aware mode selection, a CMSTPLUA COM UAC bypass, PEB masquerading to impersonate explorer.exe, scheduled-task persistence running every three minutes, and disabling of the Task Scheduler operational event log. Aliases directly supported by the content are TA582 and UNC4108.