TA551 has previously distributed malware payloads such as Ursnif, IcedID, Qbot, and Emotet. This actor acts as an initial access facilitator for ransomware threat actors. Proofpoint has observed its campaigns leveraging banking trojans have led to ransomware infections. Proofpoint assesses with high confidence TA551 IcedID implants were associated with Maze and Egregor ransomware events in 2020. On 20 October 2021, Proofpoint observed emails that appeared to be replies to previous conversations and contained password-protected zipped Word documents. The attachments ultimately lead to the download of Sliver, an open-source, cross-platform adversary simulation and red team platform. The activity demonstrated a significant departure from previous tactics, techniques, and procedures from TA551. Figure: Thread hijacked email containing zipped Word document.