TA583

TA583 is a threat actor designated by Proofpoint in January 2025 and tracked since 2022 based on email lures, targeting, malware used, and network infrastructure. Proofpoint described TA583 as one of the most prominent threat activity sets distributing ScreenConnect and as a highly active actor conducting multiple campaigns each day. TA583 primarily used AsyncRAT before mid-2024, then shifted after mid-2024 to primarily using ScreenConnect as an initial access payload. In some infections, ScreenConnect downloaded and installed AsyncRAT, indicating its use as a loader for follow-on malware. TA583 commonly delivers ScreenConnect via URLs and also uses HTML or PDF attachments, often leveraging email shortener services, Dropbox, and Bitbucket. The actor sends emails through free consumer email accounts from telecommunications providers, email marketing and survey platforms including Sendgrid, Mailjet, and Qualtrics, as well as compromised email accounts. TA583 routinely uses lures impersonating the U.S. Social Security Administration and has also used Canada Pension Plan, U.S. Internal Revenue Service, USPS, and telecommunications-themed lures. Proofpoint observed a 6 January 2025 campaign impersonating the U.S. Social Security Administration that used URLs leading to an executable that installed ScreenConnect. TA583 uses legitimate signed ScreenConnect installers and relies on both DDNS providers and actor-owned command-and-control servers. No additional aliases or sub-groups were provided in the content.