ATT&CK

Threat actorsMITRE ATT&CK intrusion sets Malware & toolsSoftware families & tooling TechniquesTactics & techniques

ReportsPublished APT reporting SourcesEvery feed behind the archive

Developers

JSON APIFree CORS-enabled endpoints MCP serverModel Context Protocol access Source codeThis project on GitHub

Loading the archive…

Open Threat Intel Archive

Indicators are treated as facts and kept with their source_vendor, source URL, and dates; every feed is credited and redistribution-restricted feeds are flagged, not dropped. ATT&CK content is © MITRE, used under its terms. See NOTICE. The archive reports intelligence; it does not editorialize threat.

Indicators Actors Sources API GitHub

Open Threat Intel Archive

← Threat actors

G0127threat actor

TA551

a.k.a. GOLD CABIN, Shathak

TA551 is a financially-motivated threat group that has been active since at least 2018. The group has primarily targeted English, German, Italian, and Japanese speakers through email-based malware distribution campaigns.

MITRE ATT&CK ↗

Linked entities · 19

usesT1218.010Regsvr32 usesS0650QakBot usesT1589.002Email Addresses usesT1204.002Malicious File usesS0483IcedID usesS0476Valak usesT1218.011Rundll32 usesT1027.003Steganography usesT1566.001Spearphishing Attachment usesT1132.001Standard Encoding usesS0633Sliver usesT1568.002Domain Generation Algorithms usesT1027.010Command Obfuscation usesT1071.001Web Protocols usesT1105Ingress Tool Transfer usesT1218.005Mshta usesT1059.003Windows Command Shell usesS0386Ursnif usesT1036Masquerading