TA505

Threat Actors · TA505

· ATT&CK GroupG0092

Hive0065Spandex TempestCHIMBORAZO

Techniques

Software

Tactics

Aliases

Description

TA505 is a cyber criminal group that has been active since at least 2014. TA505 is known for frequently changing malware, driving global trends in criminal malware distribution, and ransomware campaigns involving Clop.(Citation: Proofpoint TA505 Sep 2017)(Citation: Proofpoint TA505 June 2018)(Citation: Proofpoint TA505 Jan 2019)(Citation: NCC Group TA505)(Citation: Korean FSI TA505 2020)

Tactic Coverage

stealth (8)execution (8)defense impairment (4)resource development (4)command and control (3)initial access (3)privilege escalation (2)discovery (2)persistence (2)credential access (2)impact (1)

Techniques Used (34)

T1027.002Software Packing

stealth

T1027.010Command Obfuscation

stealth

T1027.013Encrypted/Encoded File

stealth

T1055.001Dynamic-link Library Injection

stealthprivilege escalation

T1059.001PowerShell

execution

Registration Required

Create a free account to access full Threat Actor Techniques

Showing 5 of 34 results

✓ Personal dashboard✓ Track 1 vendor/product✓ 1 keyword alert✓ Weekly digest✓ 1 CSV export/month

Already have an account? Sign in →

Software Used (16)

S0552AdFindtool S1025Amadeymalware S0344Azorultmalware S0521BloodHoundtool S0611Clopmalware S0154Cobalt Strikemalware S0384Dridexmalware S0381FlawedAmmyymalware S0383FlawedGracemalware S0460Get2malware S0002Mimikatztool S0039Nettool S0194PowerSploittool S0461SDBbotmalware S0382ServHelpermalware S0266TrickBotmalware

References (11)

https://attack.mitre.org/groups/G0092 https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory=https://web.archive.org/web/20200420201624/https://securityintelligence.com/posts/ta505-continues-to-infect-networks-with-sdbbot-rat/https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta505-dridex-globeimposter https://www.proofpoint.com/us/threat-insight/post/ta505-shifts-times https://www.proofpoint.com/us/threat-insight/post/servhelper-and-flawedgrace-new-malware-introduced-ta505 https://research.nccgroup.com/2020/11/18/ta505-a-brief-history-of-their-time/