TA2541 is an emerging threat actor whom targets aviation, aeronautical, aerospace, manufacturing, and defense industries and has been active in-the-wild since 2017. This cybercriminal commonly deploys numerous remote access trojans across organizations throughout these industries via social engineering tactics. Within these emails, themed after transportation services like aircraft, yacht, and charters, malicious RAR executables are attached which allow for an outbound connection to a threat actor controlled command-and-control (C2) server where additional payloads are downloaded to the victim’s device. Payloads from this threat actor include the AsyncRAT, a malicious program capable of communicating over an encrypted connection harvesting system information, relaying keylogger information, and establishing persistence on the system. TA2541 has been observed utilizing other remote access trojans including NetWire, WSHRAT, and Parallax. On average, these threat actors will disperse thousands of emails to targeted organizations to employees regardless of corporate hierarchy. The amount of compromised victims tied to this threat actor is currently unknown, but is believed to still be targeting companies within these industries and will do so in the future.