H3XA — Operational Evidence

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[TA551](https://attack.mitre.org/groups/G0127) is a financially-motivated threat group that has been active since at least 2018. (Citation: Secureworks GOLD CABIN) The group has primarily targeted English, German, Italian, and Japanese speakers through email-based malware distribution campaigns. (Citation: Unit 42 TA551 Jan 2021)

19 recorded

Relationships

uses

to Command Obfuscation

Technique

uses

to Domain Generation Algorithms

Technique

uses

to Email Addresses

Technique

uses

Malware

uses

to Ingress Tool Transfer

Technique

uses

to Malicious File

Technique

uses

to Masquerading

Technique

uses

Technique

uses

Malware

uses

Technique

uses

Technique

uses

Tool

uses

to Spearphishing Attachment

Technique

uses

to Standard Encoding

Technique

uses

to Steganography

Technique

uses

Malware

uses

Malware

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

6 external

References

mitre-attack

G0127

GOLD CABIN

—

Shathak

—

Unit 42 Valak July 2020

https://unit42.paloaltonetworks.com/valak-evolution/

Unit 42 TA551 Jan 2021

https://unit42.paloaltonetworks.com/ta551-shathak-icedid/

Secureworks GOLD CABIN

https://www.secureworks.com/research/threat-profiles/gold-cabin