CVE Intelligence
Home / Threat actors / TA2541

TA2541 G1018

🔔 Create alert

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

0
associated CVEs
33
Techniques
9
Malware and tools

TA2541 is a cybercriminal group that has been targeting the aviation, aerospace, transportation, manufacturing, and defense industries since at least 2017. TA2541 campaigns are typically high volume and involve the use of commodity remote access tools obfuscated by crypters and themes related to aviation, transportation, and travel.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

ATT&CK does not cite CVEs for this group.

Techniques by tactic

Resource Development
T1583.001 DomainsT1583.006 Web ServicesT1588.001 MalwareT1588.002 ToolT1608.001 Upload Malware
Initial Access
T1566.001 Spearphishing AttachmentT1566.002 Spearphishing Link
Execution
T1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1059.001 PowerShellT1059.005 Visual BasicT1204.001 Malicious LinkT1204.002 Malicious File
Persistence
T1053.005 Scheduled TaskT1547.001 Registry Run Keys / Startup Folder
Privilege Escalation
T1053.005 Scheduled TaskT1055 Process InjectionT1055.012 Process HollowingT1547.001 Registry Run Keys / Startup Folder
Stealth
T1027.002 Software PackingT1027.013 Encrypted/Encoded FileT1027.015 CompressionT1036.005 Match Legitimate Resource Name or LocationT1055 Process InjectionT1055.012 Process HollowingT1218.005 Mshta
Defense Impairment
T1685 Disable or Modify Tools
Discovery
T1016.001 Internet Connection DiscoveryT1082 System Information DiscoveryT1518.001 Security Software Discovery
Command and Control
T1105 Ingress Tool TransferT1568 Dynamic ResolutionT1573.002 Asymmetric Cryptography

Malware and tools

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.