G1018: TA2541

G1018: TA2541 describes [TA2541](https://attack.mitre.org/groups/G1018) is a cybercriminal group that has been targeting the aviation, aerospace, transportation, manufacturing, and defense industries since at least 2017. [TA2541](https://attack.mitre.org/groups/G1018) campaigns are typically high volume and involve the use of commodity remote access tools obfuscated by crypters and themes related to aviation, transportation, and travel.(Citation: Proofpoint TA2541 February 2022)(Citation: Cisco Operation Layover September 2021)

Executive priority

G1018: TA2541 is an official MITRE ATT&CK group. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate G1018: TA2541 by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (the platforms named in the official object), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

Official ATT&CK relationships and object metadata

Detection direction

Validate whether G1018: TA2541 appears in your detection coverage and tabletop scenarios.
Use the object to align executive risk language with SOC, incident response, and detection engineering work.
Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

Map the object to existing controls and identify missing telemetry or response ownership.
Prioritize mitigations that reduce exposure on the listed platforms and tactics.
Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.

Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

TA2541

TA2541 is a cybercriminal group that has been targeting the aviation, aerospace, transportation, manufacturing, and defense industries since at least 2017. TA2541 campaigns are typically high volume and involve the use of commodity remote access tools obfuscated by crypters and themes related to aviation, transportation, and travel.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques28 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1608.001	Upload MalwareSub-technique	TA2541 has uploaded malware to various platforms including Google Drive, Pastetext, Sharetext, and GitHub.[1][2]
Enterprise	T1547.001	Registry Run Keys / Startup FolderSub-technique	TA2541 has placed VBS files in the Startup folder and used Registry run keys to establish persistence for malicious payloads.[1]
Enterprise	T1573.002	Asymmetric CryptographySub-technique	TA2541 has used TLS encrypted C2 communications including for campaigns using AsyncRAT.[2]
Enterprise	T1105	Ingress Tool Transfer	TA2541 has used malicious scripts and macros with the ability to download additional payloads.[2]
Enterprise	T1568	Dynamic Resolution	TA2541 has used dynamic DNS services for C2 infrastructure.[1]
Enterprise	T1036.005	Match Legitimate Resource Name or LocationSub-technique	TA2541 has used file names to mimic legitimate Windows files or system functionality.[1]
Enterprise	T1518.001	Security Software DiscoverySub-technique	TA2541 has used tools to search victim systems for security products such as antivirus and firewall software.[1]
Enterprise	T1053.005	Scheduled TaskSub-technique	TA2541 has used scheduled tasks to establish persistence for installed tools.[1]
Enterprise	T1027.002	Software PackingSub-technique	TA2541 has used a .NET packer to obfuscate malicious files.[2]
Enterprise	T1082	System Information Discovery	TA2541 has collected system information prior to downloading malware on the targeted host.[1]
Enterprise	T1685	Disable or Modify Tools	TA2541 has attempted to disable built-in security protections such as Windows AMSI. [1]
Enterprise	T1588.001	MalwareSub-technique	TA2541 has used multiple strains of malware available for purchase on criminal forums or in open-source repositories.[1]
Enterprise	T1218.005	MshtaSub-technique	TA2541 has used `mshta` to execute scripts including VBS.[2]
Enterprise	T1588.002	ToolSub-technique	TA2541 has used commodity remote access tools.[2]
Enterprise	T1204.001	Malicious LinkSub-technique	TA2541 has used malicious links to cloud and web services to gain execution on victim machines.[1]CitationFireEye NETWIRE March 2019
Enterprise	T1583.001	DomainsSub-technique	TA2541 has registered domains often containing the keywords “kimjoy,” “h0pe,” and “grace,” using domain registrars including Netdorm and No-IP DDNS, and hosting providers including xTom GmbH and Danilenko, Artyom.[1][2]
Enterprise	T1055	Process Injection	TA2541 has injected malicious code into legitimate .NET related processes including regsvcs.exe, msbuild.exe, and installutil.exe.[1][2]
Enterprise	T1059.001	PowerShellSub-technique	TA2541 has used PowerShell to download files and to inject into various Windows processes.[1]
Enterprise	T1027.013	Encrypted/Encoded FileSub-technique	TA2541 has used compressed and char-encoded scripts in operations.[2]
Enterprise	T1016.001	Internet Connection DiscoverySub-technique	TA2541 has run scripts to check internet connectivity from compromised hosts. [2]
Enterprise	T1055.012	Process HollowingSub-technique	TA2541 has used process hollowing to execute CyberGate malware.[2]
Enterprise	T1047	Windows Management Instrumentation	TA2541 has used WMI to query targeted systems for security products.[1]
Enterprise	T1204.002	Malicious FileSub-technique	TA2541 has used macro-enabled MS Word documents to lure victims into executing malicious payloads.[1][2]CitationTelefonica Snip3 December 2021
Enterprise	T1059.005	Visual BasicSub-technique	TA2541 has used VBS files to execute or establish persistence for additional payloads, often using file names consistent with email themes or mimicking system functionality.[1][2]
Enterprise	T1566.002	Spearphishing LinkSub-technique	TA2541 has used spearphishing e-mails with malicious links to deliver malware. [1]CitationTelefonica Snip3 December 2021
Enterprise	T1027.015	CompressionSub-technique	TA2541 has used compressed and char-encoded scripts in operations.[2]
Enterprise	T1566.001	Spearphishing AttachmentSub-technique	TA2541 has sent phishing emails with malicious attachments for initial access including MS Word documents.[1][2]
Enterprise	T1583.006	Web ServicesSub-technique	TA2541 has hosted malicious files on various platforms including Google Drive, OneDrive, Discord, PasteText, ShareText, and GitHub.[1]

Associated objects

Groups, software, and campaigns

S1086: Snip3

Snip3 is a sophisticated crypter-as-a-service that has been used since at least 2021 to obfuscate and load numerous strains of malware including AsyncRAT, Revenge RAT, Agent Tesla, and NETWIRE.[1][2]

Windows

S0379: Revenge RAT

Revenge RAT is a freely available remote access tool written in .NET (C#).[1][2]

Windows

S0283: jRAT

jRAT is a cross-platform, Java-based backdoor originally available for purchase in 2012. Variants of jRAT have been distributed via a software-as-a-service platform, similar to an online subscription model.[1] [2]

LinuxWindowsmacOS

S0670: WarzoneRAT

WarzoneRAT is a malware-as-a-service remote access tool (RAT) written in C++ that has been publicly available for purchase since at least late 2018.[1][2]

Windows

S0434: Imminent Monitor

Imminent Monitor was a commodity remote access tool (RAT) offered for sale from 2012 until 2019, when an operation was conducted to take down the Imminent Monitor infrastructure. Various cracked versions and variations of this RAT are still in circulation.[1]

Windows

S1087: AsyncRAT

AsyncRAT is an open-source remote access tool originally available through the NYANxCAT Github repository that has been used in malicious campaigns.[1][2][3]

Windows

S0198: NETWIRE

NETWIRE is a publicly available, multiplatform remote administration tool (RAT) that has been used by criminal and APT groups since at least 2012.[1][2][3]

WindowsLinuxmacOS

S0331: Agent Tesla

Agent Tesla is a spyware Trojan written for the .NET framework that has been observed since at least 2014.[1][2][3]

Windows

S0385: njRAT

njRAT is a remote access tool (RAT) that was first observed in 2012. It has been used by threat actors in the Middle East.[1]

Windows

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 19.2
Object version: 1.1
Created: Sep 12, 2023, 17:00 UTC (UTC+00:00)
Modified: Jul 31, 2026, 18:47 UTC (UTC+00:00)
Raw hash: 7cb2fafa3daf9004...

Imported snapshots across ATT&CK releases(2)

Release	Bundle imported	Object version	Modified	Status	Raw hash
19.2	Aug 6, 2026, 02:58 UTC (UTC+00:00)	1.1	Jul 31, 2026, 18:47 UTC (UTC+00:00)	Current bundle	`7cb2fafa3daf…`
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	1.1	Apr 10, 2024, 22:38 UTC (UTC+00:00)	Older bundle	`4e43a137d034…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
Proofpoint TA2541 February 2022
Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.
Open source URL
[2]
Cisco Operation Layover September 2021
Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.
Open source URL
[3]
mitre-attackG1018
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use

Security context for executives and security teams

Executive priority

Technical view

Likely telemetry

Detection direction

Mitigation priorities

TA2541

How security teams should use this page

Techniques used

Groups, software, and campaigns

All related ATT&CK context

Object version and sync metadata

Mirrored ATT&CK source object

External references and citations