D
CyberUnattributed

TA551

Cybercriminal groupTrackedPending verification

Also known as: GOLD CABIN, Shathak

CyberUNK
Identification silhouette. Not drawn to scale between entries.
Fact cardConfidence · Source
System
TypeCybercriminal group
Alternative designationsGOLD CABIN, Shathak
ProliferationOrigin country only
Active since2018At least 2018Med[1]
MITRE ATT&CK IDG0127High[1]
Capabilities
ATT&CK techniques used14ATT&CK v20.1High[1]
Malware and toolsIcedID, QakBot, Sliver, Ursnif, Valak5 malware and tool entries linked in ATT&CKHigh[1]
Attribution and activity
Attributed sponsorFinancially motivated groupMed[1]
TargetsThe group has primarily targeted English, German, Italian, and Japanese speakers through email-based malware distribution campaigns.Med[1]
Notes
TA551 is a financially-motivated threat group that has been active since at least 2018. The group has primarily targeted English, German, Italian, and Japanese speakers through email-based malware distribution campaigns. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.
Summary

TA551 is a financially-motivated threat group that has been active since at least 2018. The group has primarily targeted English, German, Italian, and Japanese speakers through email-based malware distribution campaigns.

Draft entry. Values come from the cited public sources and are awaiting editor verification.
CompareJSON
Operators
Sources
  1. TA551, Group G0127, MITRE ATT&CK
    Published/updated 2026-07-31 · Tier 2 · checked 2026-11-08
Change log
  • 2026-11-08 Entry created from MITRE ATT&CK Enterprise v20.1 (group G0127)