# TA2541: threat group profile

> TA2541 is a threat group. Public reporting links it to 20 attack techniques. This free profile shows how it works, stage by stage, so you can judge the risk to you. It lists the other names the group goes by and links to every public report behind it.

Canonical page: https://www.edgeprotect.io/threat-actors/ta2541
Breadcrumb: [Home](https://www.edgeprotect.io/) > [Threat groups](https://www.edgeprotect.io/threat-actors) > TA2541

## At a glance

| Fact | Value |
|---|---|
| Attack techniques | 20 (plus 21 sub-techniques) |
| Thought to operate from | Not known |
| Other names | 0 |
| Public reports | 1 |

## Who is TA2541?

TA2541 is a threat group. Public reporting links it to 20 attack techniques.

### What public reporting says

> Persistent cybercrime threat actor targeting aviation, aerospace, transportation, manufacturing, and defense industries for years. This threat actor consistently uses remote access trojans (RATs) that can be used to remotely control compromised machines. This threat actor uses consistent themes related to aviation, transportation, and travel. The threat actor has used similar themes and targeting since 2017.

## How does TA2541 attack? Stage by stage

Each technique is a known way attackers research, get in, stay hidden or do damage. Here are the 20 linked to TA2541. Some techniques belong to more than one stage. Public reporting also lists 21 more specific variations of them, called sub-techniques.

### 1. Research (0)

- None linked in public reporting.

### 2. Preparation (3)

- T1583: Acquire Infrastructure
- T1588: Obtain Capabilities
- T1608: Stage Capabilities

### 3. Getting in (1)

- T1566: Phishing

### 4. Running code (4)

- T1047: Windows Management Instrumentation
- T1053: Scheduled Task/Job
- T1059: Command and Scripting Interpreter
- T1204: User Execution

### 5. Staying in (2)

- T1053: Scheduled Task/Job
- T1547: Boot or Logon Autostart Execution

### 6. Taking control (3)

- T1053: Scheduled Task/Job
- T1055: Process Injection
- T1547: Boot or Logon Autostart Execution

### 7. Hiding (4)

- T1027: Obfuscated Files or Information
- T1036: Masquerading
- T1055: Process Injection
- T1218: System Binary Proxy Execution

### 8. Disabling defences (1)

- T1685: Disable or Modify Tools

### 9. Stealing passwords (0)

- None linked in public reporting.

### 10. Looking around (3)

- T1016: System Network Configuration Discovery
- T1082: System Information Discovery
- T1518: Software Discovery

### 11. Spreading (0)

- None linked in public reporting.

### 12. Gathering data (0)

- None linked in public reporting.

### 13. Keeping contact (3)

- T1105: Ingress Tool Transfer
- T1568: Dynamic Resolution
- T1573: Encrypted Channel

### 14. Taking data out (0)

- None linked in public reporting.

### 15. Causing damage (0)

- None linked in public reporting.

## Public reports about TA2541

- https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight

## Frequently asked questions

### Who is TA2541?

TA2541 is a threat group. Public reporting links it to 20 attack techniques.

### How does TA2541 attack?

Public reporting links TA2541 to 20 attack techniques. Most of them are about running code, hiding and preparation.

### How do I know if TA2541 is a risk to my business?

Create an account and tell us the software you run. We match it against known flaws, including those linked to threat groups, rank each one from 0 to 100 and tell you as soon as we spot something that affects you.

## Check whether it matters to your business

A free EdgeProtect account (no card needed) matches the software you run against known flaws, including those linked to threat groups, ranks each one from 0 to 100 and tells you as soon as we spot something that affects you. It also shows which threat groups and ransomware gangs are hitting your sector, with profiles of over 900 groups and a PDF dossier for each.

- Start free: https://www.edgeprotect.io/register
- Book a demo: https://www.edgeprotect.io/contact