Cyber Threat Actor: TA542

TA542, also known as Mummy Spider, is a threat actor group that has been observed distributing the Emotet malware family. The group’s location is noted as Japan in the available information, though its operational reach extends beyond a single country. TA542’s activity is characterized by the use of socially engineered email messages that masquerade as legitimate correspondence to deliver malicious payloads. These emails often contain password‑protected archive files or encrypted ZIP attachments designed to evade detection mechanisms. Once opened, the attachments deploy Emotet, which can then exfiltrate email data, harvest credentials, and facilitate the spread of additional malware through reply‑chain hijacking techniques.

The incidents publicly linked to TA542 reveal a pattern of targeting diverse sectors and geographic regions. A Japanese manufacturing firm experienced credential theft and subsequent impersonation attempts after an Emotet infection compromised employee workstations. In Lithuania, the National Center for Public Health and several municipal networks were compromised via Emotet‑laden emails that used reply‑chain tactics to increase credibility, leading to widespread internal spam and the temporary shutdown of email services. A healthcare organization serving Native American communities in the United States’ Northwest suffered a breach that exposed personal health information after employees responded to a phishing message that delivered Emotet. These examples show that the actor has engaged with manufacturing, public health, and healthcare sectors across Asia, Europe, and North America. The provided sources do not explicitly state the actor’s strategic objectives, such as financial gain, espionage, or disruption, so those aspects remain unspecified in this profile.

Attribution of TA542 to a specific state sponsor or criminal consortium is not detailed in the supplied material; the group is primarily recognized as a distributor of Emotet without publicly asserted ties to nation‑state actors. The campaigns described above serve as representative illustrations of TA542’s operational style, highlighting reliance on phishing, malicious attachments, and the exploitation of trusted email threads to propagate malware. The actor’s infrastructure enables rapid dissemination of Emotet variants, which in turn supports secondary payload delivery and credential harvesting efforts across compromised networks. No additional details about the group’s size, internal structure, or revenue sources are available from the referenced sources, and therefore such elements are omitted to maintain factual accuracy.