Menu
Sign In Search Podcasts Charts People & Topics Add Podcast API Pricing
Podcast Image

DISCARDED: Tales From the Threat Research Trenches

Threat Actor Theater: TA2541, TA558, and the Cyber Heist Crew TA582

29 Jul 2025

Description

Send us fan mail!Hello to all our cyber pals! In this episode of Discarded, host Selena Larson and co-host, Tim Kromphardt, are joined by Joe Wise, Senior Threat Researcher at Proofpoint for a deep dive into the chaotic brilliance of mid-tier eCrime actors—including the elusive TA582.We explore recent activity from TA2541 and TA558—two groups known for their uncanny consistency and precision targeting—before shifting focus to TA582: a standout in today’s threat landscape. TA582’s multilayered, region-specific lures (think vintage car sales and fake speeding tickets) and complex delivery models are impressive compared to your typical cybercriminal.Topics Include:🔍 What you’ll hear:How TA2541 and TA558 maintain eerily consistent lures and targeting year after yearThe regional flavor behind lures in Latin America and Europe—especially during tax seasonWhy TA582 feels like a digital jigsaw puzzle, with simultaneous email, web inject, and compromised site vectorsA breakdown of TA582’s evolving payloads, from GhostWeaver to Interlock RATThe surprising links between threat actor collaboration, initial access brokers, and shifting loader trendsHow weird or silly variable names can enable threat actor trackingAnd yes—13 URLs that needs the Tron soundtrack playing in the background to exploreFor more information about Proofpoint, check out our website. Subscribe & Follow:Stay ahead of emerging threats, and subscribe! Happy hunting!

Audio
Featured in this Episode

No persons identified in this episode.

Transcription

This episode hasn't been transcribed yet

Help us prioritize this episode for transcription by upvoting it.

0 upvotes
🗳️ Sign in to Upvote

Popular episodes get transcribed faster

Comments

There are no comments yet.

Please log in to write the first comment.