#1 Middle East & Africa Trusted Cybersecurity News & Magazine |

37.2 C
Friday, June 14, 2024
Cybercory Cybersecurity Magazine
HomeIndustriesBanking & FinanceInvoice Intrigue: TA547 Targets German Firms with Rhadamanthys Stealer

Invoice Intrigue: TA547 Targets German Firms with Rhadamanthys Stealer


Related stories

Shielding Your Inbox: Top 10 Email Security Gateway Solutions in 2024

Our inboxes are gateways to our personal and professional...

Fortressing Your Business Data: Top 10 Most Secure ERP Systems in 2024

In today's data-driven business landscape, Enterprise Resource Planning (ERP)...

How To Avoid Online Shopping Scams?: The Siren Song of Savings

The allure of online shopping is undeniable. From the...

The Digital Fortress: Top 10 Most Secure Operating Systems in 2024

The operating system (OS) forms the foundation of your...

Guarded Gates: Top Best 10 Secure Email Services in 2024

In today's digital age, email remains a cornerstone of...

German organizations are on high alert following a phishing campaign targeting them with a novel information stealer. The culprit? A financially motivated threat actor group known as TA547.

Let’s dissect this campaign, understand the Rhadamanthys stealer, and explore best practices to safeguard your organization from similar threats.

TA547: A Persistent Threat Actor

TA547 is a prolific cybercriminal group with a history of targeting various regions with email phishing campaigns. Known for their flexibility, they’ve utilized malware like ZLoader, Gootkit, DanaBot, Ursnif, and even Adhlam-Shim ransomware in past attacks. This latest campaign, however, marks a shift in their tactics.

Rhadamanthys Stealer: A New Face in the Game

This campaign leverages the Rhadamanthys stealer, a malware program not previously linked to TA547. Rhadamanthys specializes in siphoning sensitive information from compromised systems, including:

  • Login credentials
  • Financial data
  • Personal information
  • Corporate data

Dissecting the Phishing Campaign

TA547’s emails are crafted to appear legitimate, often mimicking invoices from trusted vendors. These emails typically contain a password-protected ZIP file with a decoy filename (e.g., MAR26.zip) designed to trick recipients into lowering their guard. Once extracted, the ZIP file contains an LNK (link) file. Clicking this LNK triggers a PowerShell script that downloads and executes the Rhadamanthys stealer payload in memory, bypassing traditional disk-based detection methods.

Proofpoint Discovers the Deception

Security researchers at Proofpoint were the first to identify this campaign, highlighting TA547’s evolving tactics and their possible use of large language models (LLMs) to generate the malicious PowerShell scripts. This incident underscores the need for continuous vigilance and advanced threat detection solutions.

10 Ways to Fortify Your Defenses

Here are 10 actionable steps organizations can take to protect themselves from phishing attacks like the one employed by TA547:

  1. Educate Employees: Train employees on phishing tactics, red flags to watch for, and best practices for handling suspicious emails.
  2. Implement Email Security Solutions: Utilize email filtering and security solutions that can detect phishing attempts and malicious attachments.
  3. Enforce Secure Email Gateways: Configure secure email gateways to scan incoming and outgoing emails for malware and suspicious content.
  4. Disable Macros: Disable macros in Microsoft Office documents by default to prevent malicious scripts from executing.
  5. Implement Multi-Factor Authentication (MFA): Enforce MFA wherever possible to add an extra layer of security beyond passwords.
  6. Maintain Software Updates: Ensure all systems are updated with the latest security patches to address known vulnerabilities.
  7. Segment Your Network: Implement network segmentation to limit the potential impact of a successful phishing attack.
  8. Maintain Backups: Regularly back up critical data to facilitate recovery in case of a cyberattack.
  9. Simulate Phishing Attacks: Conduct regular phishing simulations to test employee awareness and preparedness.
  10. Stay Informed: Subscribe to cybersecurity advisories and news sources to stay updated on emerging threats and tactics.


The TA547 phishing campaign targeting German firms with the Rhadamanthys stealer serves as a stark reminder that cybercriminals are constantly refining their methods. By prioritizing employee education, implementing robust security solutions, and fostering a culture of cybersecurity awareness, organizations can significantly reduce their risk of falling victim to such attacks.

Ouaissou DEMBELE
Ouaissou DEMBELEhttps://cybercory.com
Ouaissou DEMBELE is an accomplished cybersecurity professional and the Editor-In-Chief of cybercory.com. He has over 10 years of experience in the field, with a particular focus on Ethical Hacking, Data Security & GRC. Currently, Ouaissou serves as the Co-founder & Chief Information Security Officer (CISO) at Saintynet, a leading provider of IT solutions and services. In this role, he is responsible for managing the company's cybersecurity strategy, ensuring compliance with relevant regulations, and identifying and mitigating potential threats, as well as helping the company customers for better & long term cybersecurity strategy. Prior to his work at Saintynet, Ouaissou held various positions in the IT industry, including as a consultant. He has also served as a speaker and trainer at industry conferences and events, sharing his expertise and insights with fellow professionals. Ouaissou holds a number of certifications in cybersecurity, including the Cisco Certified Network Professional - Security (CCNP Security) and the Certified Ethical Hacker (CEH), ITIL. With his wealth of experience and knowledge, Ouaissou is a valuable member of the cybercory team and a trusted advisor to clients seeking to enhance their cybersecurity posture.


- Never miss a story with notifications

- Gain full access to our premium content

- Browse free from up to 5 devices at once

Latest stories



Please enter your comment!
Please enter your name here