{"type":"bundle","id":"bundle--b7d18aca-fc62-5321-b1c7-6adc13b54f84","objects":[{"type":"intrusion-set","id":"intrusion-set--eab82102-a3df-5080-831d-67d721830ead","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","name":"TA577","description":"TA577 (also known as Hive0118) is a financially motivated cybercriminal threat actor active since 2020, operating as an initial access broker and malware distributor with a broad targeting footprint spanning North America, Europe, Asia-Pacific, and the Middle East. The group conducts high-volume phishing and malspam campaigns delivering malware payloads—including information stealers and ransomware—across a wide range of sectors such as finance, manufacturing, healthcare, logistics, retail, and professional services. Their primary motivation is financial gain, achieved through deploying ransomware, facilitating data theft, or selling access to compromised networks to downstream threat actors.","aliases":["`proofpoint:TA577","Hive0118`","Hive0118","UNC1543"],"first_seen":"2020-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/ta577"}],"labels":["cybercrime","fin","ran"]},{"type":"attack-pattern","id":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","name":"Windows Command Shell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.003","url":"https://attack.mitre.org/techniques/T1059/003"}]},{"type":"relationship","id":"relationship--29cfc043-eb03-502a-bc72-9ae4cc9bd64c","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","relationship_type":"uses","source_ref":"intrusion-set--eab82102-a3df-5080-831d-67d721830ead","target_ref":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b"},{"type":"attack-pattern","id":"attack-pattern--b89d0ac8-c6b0-520b-b42a-2bde78a994dc","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","name":"JavaScript","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.007","url":"https://attack.mitre.org/techniques/T1059/007"}]},{"type":"relationship","id":"relationship--f08f2891-b973-50cc-980b-2c392e513d9c","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","relationship_type":"uses","source_ref":"intrusion-set--eab82102-a3df-5080-831d-67d721830ead","target_ref":"attack-pattern--b89d0ac8-c6b0-520b-b42a-2bde78a994dc"},{"type":"attack-pattern","id":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","name":"Malicious Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1204.001","url":"https://attack.mitre.org/techniques/T1204/001"}]},{"type":"relationship","id":"relationship--bb9501ae-18da-5673-b76a-f779aba9b1f5","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","relationship_type":"uses","source_ref":"intrusion-set--eab82102-a3df-5080-831d-67d721830ead","target_ref":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc"},{"type":"attack-pattern","id":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","name":"Spearphishing Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.002","url":"https://attack.mitre.org/techniques/T1566/002"}]},{"type":"relationship","id":"relationship--be2d3917-0445-54b2-9e2a-862e3e9b154b","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","relationship_type":"uses","source_ref":"intrusion-set--eab82102-a3df-5080-831d-67d721830ead","target_ref":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd"},{"type":"location","id":"location--8c2bc2e0-62b9-53f4-aaa8-b8b8b4bcfb25","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","name":"Austria","country":"AT","region":"europe"},{"type":"relationship","id":"relationship--070a8d75-fbeb-541b-ae8a-7de02f439719","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","relationship_type":"targets","source_ref":"intrusion-set--eab82102-a3df-5080-831d-67d721830ead","target_ref":"location--8c2bc2e0-62b9-53f4-aaa8-b8b8b4bcfb25"},{"type":"location","id":"location--0375fcf1-94fe-5ba0-b36d-c031719c346a","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","name":"Australia","country":"AU","region":"oceania"},{"type":"relationship","id":"relationship--87c456ce-00eb-5104-8758-1888d16dca1c","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","relationship_type":"targets","source_ref":"intrusion-set--eab82102-a3df-5080-831d-67d721830ead","target_ref":"location--0375fcf1-94fe-5ba0-b36d-c031719c346a"},{"type":"location","id":"location--2a0210fd-890b-5862-bd01-f2cd5e77b2a5","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","name":"Belgium","country":"BE","region":"europe"},{"type":"relationship","id":"relationship--5c2671ea-9a61-5c7d-b5a7-2b3fb95874b9","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","relationship_type":"targets","source_ref":"intrusion-set--eab82102-a3df-5080-831d-67d721830ead","target_ref":"location--2a0210fd-890b-5862-bd01-f2cd5e77b2a5"},{"type":"location","id":"location--df32d83f-5f4c-5118-a126-3f5c603db260","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","name":"Canada","country":"CA","region":"americas"},{"type":"relationship","id":"relationship--a8ab649c-e6dd-5c4d-92d9-9b54a84f270d","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","relationship_type":"targets","source_ref":"intrusion-set--eab82102-a3df-5080-831d-67d721830ead","target_ref":"location--df32d83f-5f4c-5118-a126-3f5c603db260"},{"type":"location","id":"location--28c31ddb-f375-5682-8697-e338a5f5d82f","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","name":"Switzerland","country":"CH","region":"europe"},{"type":"relationship","id":"relationship--54aa08c1-ea04-5b5b-b5cd-06df73a497b3","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","relationship_type":"targets","source_ref":"intrusion-set--eab82102-a3df-5080-831d-67d721830ead","target_ref":"location--28c31ddb-f375-5682-8697-e338a5f5d82f"},{"type":"location","id":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","name":"Germany","country":"DE","region":"europe"},{"type":"relationship","id":"relationship--09a86fad-879c-52c3-b375-4a79de3697a9","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","relationship_type":"targets","source_ref":"intrusion-set--eab82102-a3df-5080-831d-67d721830ead","target_ref":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da"},{"type":"location","id":"location--bb45582d-2e27-5828-aa2f-343b24630f35","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","name":"Denmark","country":"DK","region":"europe"},{"type":"relationship","id":"relationship--ee336ed5-b1a5-58c6-95a6-bcc0fc187dc7","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","relationship_type":"targets","source_ref":"intrusion-set--eab82102-a3df-5080-831d-67d721830ead","target_ref":"location--bb45582d-2e27-5828-aa2f-343b24630f35"},{"type":"location","id":"location--6ee49119-9c76-57b4-b10a-de8f817f7ad5","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","name":"Spain","country":"ES","region":"europe"},{"type":"relationship","id":"relationship--0c88ac5c-6f3d-5ede-9195-fd4be947ca5a","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","relationship_type":"targets","source_ref":"intrusion-set--eab82102-a3df-5080-831d-67d721830ead","target_ref":"location--6ee49119-9c76-57b4-b10a-de8f817f7ad5"},{"type":"location","id":"location--972e7358-1465-509f-837b-fd47d292f53d","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","name":"Finland","country":"FI","region":"europe"},{"type":"relationship","id":"relationship--02761eb4-23cd-5bd8-86b7-c71552bf8d6b","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","relationship_type":"targets","source_ref":"intrusion-set--eab82102-a3df-5080-831d-67d721830ead","target_ref":"location--972e7358-1465-509f-837b-fd47d292f53d"},{"type":"location","id":"location--a41caef2-fe04-5da5-bc82-ec135954366c","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","name":"France","country":"FR","region":"europe"},{"type":"relationship","id":"relationship--3260205d-4244-5be8-ac40-ce0784977d9b","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","relationship_type":"targets","source_ref":"intrusion-set--eab82102-a3df-5080-831d-67d721830ead","target_ref":"location--a41caef2-fe04-5da5-bc82-ec135954366c"},{"type":"location","id":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","name":"United Kingdom","country":"GB","region":"europe"},{"type":"relationship","id":"relationship--2a3079c7-f78a-5a20-beee-7366f84adfa0","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","relationship_type":"targets","source_ref":"intrusion-set--eab82102-a3df-5080-831d-67d721830ead","target_ref":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6"},{"type":"location","id":"location--6e5b4c5e-7bd4-57d1-b1ea-657b1891ea82","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","name":"India","country":"IN","region":"asia"},{"type":"relationship","id":"relationship--2a270410-8b17-58f9-878b-0561cd098aa4","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","relationship_type":"targets","source_ref":"intrusion-set--eab82102-a3df-5080-831d-67d721830ead","target_ref":"location--6e5b4c5e-7bd4-57d1-b1ea-657b1891ea82"},{"type":"location","id":"location--fd98b554-2d31-56db-8bc0-812e65009813","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","name":"Italy","country":"IT","region":"europe"},{"type":"relationship","id":"relationship--f077bd12-3021-5d43-8b9c-a79bd63357f1","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","relationship_type":"targets","source_ref":"intrusion-set--eab82102-a3df-5080-831d-67d721830ead","target_ref":"location--fd98b554-2d31-56db-8bc0-812e65009813"},{"type":"location","id":"location--999a2449-9639-5ace-8d27-777c4f47976b","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","name":"Jamaica","country":"JM","region":"americas"},{"type":"relationship","id":"relationship--7042f2f8-3fe4-5db3-a981-c261f50033c8","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","relationship_type":"targets","source_ref":"intrusion-set--eab82102-a3df-5080-831d-67d721830ead","target_ref":"location--999a2449-9639-5ace-8d27-777c4f47976b"},{"type":"location","id":"location--92b5ebe6-9601-5191-93ab-d8960eb05b36","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","name":"Liechtenstein","country":"LI","region":"europe"},{"type":"relationship","id":"relationship--bf504c56-9664-559c-80a5-1ab4cf826bf2","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","relationship_type":"targets","source_ref":"intrusion-set--eab82102-a3df-5080-831d-67d721830ead","target_ref":"location--92b5ebe6-9601-5191-93ab-d8960eb05b36"},{"type":"location","id":"location--688e8d70-71a7-5dbf-9456-491580df260f","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","name":"Netherlands","country":"NL","region":"europe"},{"type":"relationship","id":"relationship--a33ae98b-93fc-5219-8701-d37f1e8f923f","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","relationship_type":"targets","source_ref":"intrusion-set--eab82102-a3df-5080-831d-67d721830ead","target_ref":"location--688e8d70-71a7-5dbf-9456-491580df260f"},{"type":"location","id":"location--74c4c4a2-e626-5e3e-adcf-be8b651868c4","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","name":"New Zealand","country":"NZ","region":"oceania"},{"type":"relationship","id":"relationship--338e88b8-ebf0-548f-b25b-e34c5648605c","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","relationship_type":"targets","source_ref":"intrusion-set--eab82102-a3df-5080-831d-67d721830ead","target_ref":"location--74c4c4a2-e626-5e3e-adcf-be8b651868c4"},{"type":"location","id":"location--f8c79602-1ba4-5643-8a4a-86331c7f1a46","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","name":"Oman","country":"OM","region":"asia"},{"type":"relationship","id":"relationship--7d12c9ad-6ffe-56b0-994d-6455407a41f3","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","relationship_type":"targets","source_ref":"intrusion-set--eab82102-a3df-5080-831d-67d721830ead","target_ref":"location--f8c79602-1ba4-5643-8a4a-86331c7f1a46"},{"type":"location","id":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","name":"United States","country":"US","region":"americas"},{"type":"relationship","id":"relationship--c0d5fc38-1ddc-5ca0-911c-f1ff0f06f14b","spec_version":"2.1","created":"2026-05-20T09:52:28.095129+00:00","modified":"2026-07-29T07:06:53.624+00:00","relationship_type":"targets","source_ref":"intrusion-set--eab82102-a3df-5080-831d-67d721830ead","target_ref":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505"}]}