Threat Actors Team Up for Post-Holiday Phishing Email Surge

Proofpoint observed a large post-holiday phishing campaign where TA866 leveraged TA571's traffic distribution system to send thousands of malicious emails to North American organizations; PDFs linked to OneDrive led to a downloader called WasabiSeed and a 'Screenshotter' payload. The campaign—blocked by Proofpoint—illustrates organized cybercrime actors outsourcing distribution via TDS networks and highlights seasonal activity pauses and returns among e-crime groups.