From e836a4a63cd89723dee7f822a1e486c9597e0dc1 Mon Sep 17 00:00:00 2001
From: Mathieu Beligon <mathieu@feedly.com>
Date: Mon, 13 Feb 2023 12:02:32 -0800
Subject: [PATCH] [threat-actors] Add TA575

---
 clusters/threat-actor.json | 55 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 55 insertions(+)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 96e0f38..548d54b 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -10061,6 +10061,61 @@
         }
       ],
       "value": "TA570"
+    },
+    {
+      "description": "TA575 is a Dridex affiliate tracked by Proofpoint since late 2020. This group distributes malware such as Dridex, Qakbot, and WastedLocker via malicious URLs, Office attachments, and password-protected files. On average, TA575 distributes almost 4,000 messages per campaign impacting hundreds of organizations.",
+      "meta": {
+        "references": [
+          "https://blogs.blackberry.com/en/2021/08/blackberry-prevents-threat-actor-group-ta575-and-dridex-malware",
+          "https://www.proofpoint.com/us/blog/threat-insight/ta575-uses-squid-game-lures-distribute-dridex-malware",
+          "https://www.zdnet.com/article/ta575-criminal-group-using-squid-game-lures-for-dridex-malware/"
+        ],
+      },
+      "related": [
+        {
+          "dest-uuid": "b4216929-1626-4444-bdd7-bfd4b68a766e",
+          "tags": [
+            "estimative-language:likelihood-probability=\"very-likely\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "f01e2711-4b48-4192-a2e8-5f56c945ca19",
+          "tags": [
+            "estimative-language:likelihood-probability=\"very-likely\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "edc5e045-5401-42bb-ad92-52b5b2ee0de9",
+          "tags": [
+            "estimative-language:likelihood-probability=\"very-likely\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "2ccaccd0-8362-4224-8497-2012e7cc7549",
+          "tags": [
+            "estimative-language:likelihood-probability=\"very-likely\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "e72a0bde-ea5b-4450-bc90-b5d2dca697b4",
+          "tags": [
+            "estimative-language:likelihood-probability=\"very-likely\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "46cbafbc-8907-42d3-9002-5327c26f8927",
+          "tags": [
+            "estimative-language:likelihood-probability=\"very-likely\""
+          ],
+          "type": "uses"
+        }
+      ],
+      "value": "TA575"
     }
   ],
   "version": 258