[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f8WOlKlJHHQPhkhca0CCeWTOBHOU_rWHP5b7x5UjEKL4":3},{"success":4,"data":5},true,{"name":6,"slug":7,"aliases":8,"description":9,"country":10,"suspected_sponsor":10,"target_industries":11,"target_countries":12,"incident_types":13,"references":14,"techniques":16,"technique_count":17,"created_at":18,"seoMetadata":19,"schemaOrg":23},"TA516","ta516",[],"This actor typically distributes instances of the SmokeLoader intermediate downloader, which, in turn, downloads additional malware of the actor’s choice -- often banking Trojans. Figure 3 shows a lure document from a November campaign in which TA516 distributed fake resumes with malicious macros that, if enabled, launch a PowerShell script that downloads SmokeLoader. In this instance, we observed SmokeLoader downloading a Monero coinminer. Since the middle of 2017, TA516 has used similar macro-laden documents as well as malicious JavaScript hosted on Google Drive to distribute both Panda Banker and a coinminer executable via SmokeLoader, often in the same campaigns.",null,[],[],[],[15],"https:\u002F\u002Fwww.thaicert.or.th\u002Fdownloads\u002Ffiles\u002FThreat_Group_Cards_v2.0.pdf",[],0,"2023-08-09T17:25:09.409843+00:00",{"title":20,"metaDescription":21,"keywords":22},"TA516 Threat Actor Profile | EdgeProtect","This actor typically distributes instances of the SmokeLoader intermediate downloader, which, in turn, downloads additional malware of the actor’s cho...","TA516, threat actor, APT, cyber threat, threat intelligence",{"@context":24,"@type":25,"name":6,"alternateName":26,"description":9,"url":27,"mainEntityOfPage":28},"https:\u002F\u002Fschema.org","Organization",[],"http:\u002F\u002Flocalhost:3000\u002Fthreat-actors\u002Fta516",{"@type":29,"@id":27},"WebPage"]