Threat intelligence / Group

TA2541

[TA2541](https://attack.mitre.org/groups/G1018) is a cybercriminal group that has been targeting the aviation, aerospace, transportation, manufacturing, and defense industries since at least 2017. [TA2541](https://attack.mitre.org/groups/G1018) campaigns are typically high volume and involve the use of commodity remote access tools obfuscated by crypters and themes related to aviation, transportation, and travel.(Citation: Proofpoint TA2541 February 2022)(Citation: Cisco Operation Layover September 2021)

Group

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[TA2541](https://attack.mitre.org/groups/G1018) is a cybercriminal group that has been targeting the aviation, aerospace, transportation, manufacturing, and defense industries since at least 2017. [TA2541](https://attack.mitre.org/groups/G1018) campaigns are typically high volume and involve the use of commodity remote access tools obfuscated by crypters and themes related to aviation, transportation, and travel.(Citation: Proofpoint TA2541 February 2022)(Citation: Cisco Operation Layover September 2021)

37 recorded

Relationships

uses

Malware

uses

to Asymmetric Cryptography

Technique

uses

Tool

uses

Technique

uses

to Disable or Modify Tools

Technique

uses

Technique

uses

to Dynamic Resolution

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Imminent Monitor

Tool

uses

to Ingress Tool Transfer

Technique

uses

to Internet Connection Discovery

Technique

uses

Malware

uses

to Malicious File

Technique

uses

to Malicious Link

Technique

uses

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

Technique

uses

Malware

uses

Malware

uses

Technique

uses

to Process Hollowing

Technique

uses

to Process Injection

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

Malware

uses

to Scheduled Task

Technique

uses

to Security Software Discovery

Technique

uses

Malware

uses

to Software Packing

Technique

uses

to Spearphishing Attachment

Technique

uses

to Spearphishing Link

Technique

uses

to System Information Discovery

Technique

uses

Technique

uses

to Upload Malware

Technique

uses

to Visual Basic

Technique

uses

Malware

uses

to Web Services

Technique

uses

to Windows Management Instrumentation

Technique

3 external

References

mitre-attack

G1018

Proofpoint TA2541 February 2022

https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight

Cisco Operation Layover September 2021

https://blog.talosintelligence.com/operation-layover-how-we-tracked-attack/