TA579

A Proofpoint-tracked cybercriminal initial-access and malware-delivery actor known for high-volume email campaigns. It uses malicious links, attachments, and social-engineering chains to deploy remote-access malware and loaders that can facilitate credential theft, data theft, or ransomware by downstream operators.