Proofpoint researchers have recently released a report on TA2541, a persistent cybercrime threat actor that has been tracked since 2017. This threat actor group has been observed targeting the defense, aviation, aerospace, transportation, and manufacturing industries primarily using phishing campaigns. The phishing campaigns typically have a maximum of 10,000 messages sent at one time and impact hundreds of organizations around the globe while primarily targeting North America, Europe, and the Middle East. The observed phishing emails contain Google Drive links (with the occasional OneDrive link) that eventually lead to the deployment of remote access trojans (RATs) on the compromised machines. TA2541 typically uses “AsyncRAT” malware but have recently been observed utilizing DiscordApp links to deploy “AgentTesla” and “Imminent Monitor” malware as Discord’s content delivery network (BDN) continues to rise in popularity. TA2541 typically focuses on malware that is available via open-source repositories or for purchase within online forums. For a deeper dive into TA2541’s infrastructure, delivery, installation, malware, and indicators of compromise (IOCs), please review Proofpoint’s report linked below.