Send us fan mail!

Hello to all our cyber pals! In this episode of Discarded, host Selena Larson and co-host, Tim Kromphardt, are joined by Joe Wise, Senior Threat Researcher at Proofpoint for a deep dive into the chaotic brilliance of mid-tier eCrime actors—including the elusive TA582.

We explore recent activity from TA2541 and TA558—two groups known for their uncanny consistency and precision targeting—before shifting focus to TA582: a standout in today’s threat landscape. TA582’s multilayered, region-specific lures (think vintage car sales and fake speeding tickets) and complex delivery models are impressive compared to your typical cybercriminal.

Topics Include:

🔍 What you’ll hear:

• How TA2541 and TA558 maintain eerily consistent lures and targeting year after year
  
  
  
• The regional flavor behind lures in Latin America and Europe—especially during tax season
  
  
  
• Why TA582 feels like a digital jigsaw puzzle, with simultaneous email, web inject, and compromised site vectors
  
  
  
• A breakdown of TA582’s evolving payloads, from GhostWeaver to Interlock RAT
  
  
  
• The surprising links between threat actor collaboration, initial access brokers, and shifting loader trends
  
  
  
• How weird or silly variable names can enable threat actor tracking
• And yes—13 URLs that needs the Tron soundtrack playing in the background to explore

For more information about Proofpoint, check out our website.

Subscribe & Follow:

Stay ahead of emerging threats, and subscribe! Happy hunting!