VERY IMPORTANT

TA4903 is a financially motivated cybercriminal threat actor that targets organizations in the U.S. with high-volume email campaigns to steal corporate credentials and conduct follow-on business email compromise. The actor frequently registers new domains related to government entities and private organizations to use in credential phishing.