Team46 and TaxOff: Two Sides of the Same Coin

Team46, formerly known as TaxOff, is an advanced persistent threat (APT) group that uses sophisticated malware and attack techniques to maintain long-term access to targeted systems. Their toolkit includes zero-day exploits, advanced multi-layer encrypted backdoors like Trinper, and reconnaissance tools. They employ phishing, DLL hijacking, PowerShell commands, and Cobalt Strike beacons to infiltrate and control victim networks. The group’s infrastructure mimics legitimate services to evade detection. While no widespread exploits are currently observed in the wild, European critical infrastructure and government sectors are particularly at risk. Mitigation involves targeted detection of indicators of compromise, strict PowerShell logging, and enhanced email security measures.

• CVE-2025-2783: Google Chrome · Incorrect Handle Provided in Unspecified CircumstancesHighVulnerability2025-03-26
• PIVOTPIPE: A New .NET-based Unofficial Beacon PayloadMalware2026-09-16
• Melofee: a look back at a Linux implant and its new variantsMalware2026-09-10
• One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law EnforcementMalware2026-07-09
• The Gentlemen are knocking: сustom backdoors and evolving tacticsMalware2026-06-29