TA570
No sourced public emblem in this profile.
reference profile · reported nexus: RU (not nationality)
One of the most active Qbot malware affiliates, Proofpoint has tracked the large cybercrime threat actor TA570 since 2018.
Source-reported aliases: DEV-0450. Associations do not prove equivalence.
Target geography
Catalog-listed countries (associations, not attack counts): No country-level metadata
No bound claim-post feed for this label.
Historical casebook
No dated record curated yet; absence does not establish inactivity.
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
No assigned review window.
References
https://www.proofpoint.com/us/blog/threat-insight/first-step-initial-access-leads-ransomware
https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/
https://isc.sans.edu/diary/TA570+Qakbot+Qbot+tries+CVE202230190+Follina+exploit+msmsdt/28728