Team46, formerly known as TaxOff, is an advanced persistent threat (APT) group that uses sophisticated malware and attack techniques to maintain long-term access to targeted systems. Their toolkit includes zero-day exploits, advanced multi-layer encrypted backdoors like Trinper, and reconnaissance tools. They employ phishing, DLL hijacking, PowerShell commands, and Cobalt Strike beacons to infiltrate and control victim networks. The group’s infrastructure mimics legitimate services to evade detection. While no widespread exploits are currently observed in the wild, European critical infrastructure and government sectors are particularly at risk. Mitigation involves targeted detection of indicators of compromise, strict PowerShell logging, and enhanced email security measures.
