NexaPulse
Subscribe
Intrusion setG1037

TA577

TA577 is an initial access broker (IAB) that has distributed QakBot and Pikabot, and was among the first observed groups distributing Latrodectus in 2023.

Documented techniques
6
Basis
MITRE ATT&CK

How they break in

Techniques MITRE has documented this group using, grouped by the stage of an attack they belong to. This is the actionable half: each one is a behaviour you can look for in your own logs, and a control you can test.

resource development1

initial access1

execution3

stealth1

Malware

Families MITRE records this group deploying. Detection names for these are a reasonable place to start.

LatrodectusPikabotQakBot
Source: MITRE ATT&CK View the original record · Last synchronised 2026-09-09 · Origin and motivation are read from MITRE’s own description and are not structured fields in ATT&CK. Where the text does not attribute a group, this page leaves them blank rather than guessing.