{
  "id": "ta2541",
  "name": "TA2541",
  "aliases": [],
  "domain": "cyber",
  "country": "UNK",
  "category": "Cybercriminal group",
  "status": "tracked",
  "fielded": null,
  "operators": [],
  "summary": "TA2541 is a cybercriminal group that has been targeting the aviation, aerospace, transportation, manufacturing, and defense industries since at least 2017. TA2541 campaigns are typically high volume and involve the use of commodity remote access tools obfuscated by crypters and themes related to aviation, transportation, and travel.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Cybercriminal group",
      "src": [
        "mitre-g1018"
      ],
      "conf": "medium"
    },
    {
      "k": "active_since",
      "v": 2017,
      "src": [
        "mitre-g1018"
      ],
      "conf": "medium",
      "note": "At least 2017"
    },
    {
      "k": "attack_id",
      "v": "G1018",
      "src": [
        "mitre-g1018"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "TA2541 is a cybercriminal group that has been targeting the aviation, aerospace, transportation, manufacturing, and defense industries since at least 2017.",
      "src": [
        "mitre-g1018"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 28,
      "src": [
        "mitre-g1018"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "Agent Tesla, AsyncRAT, Imminent Monitor, jRAT, NETWIRE, njRAT, Revenge RAT, Snip3, WarzoneRAT",
      "src": [
        "mitre-g1018"
      ],
      "conf": "high",
      "note": "9 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "TA2541 is a cybercriminal group that has been targeting the aviation, aerospace, transportation, manufacturing, and defense industries since at least 2017. TA2541 campaigns are typically high volume and involve the use of commodity remote access tools obfuscated by crypters and themes related to aviation, transportation, and travel. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G1018)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/ta2541.html",
  "sources": {
    "mitre-g1018": {
      "title": "TA2541, Group G1018",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G1018/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}