TA505
BedrohungsakteurRU01
auch bekannt als
Weitere Namen und Kennungen dieser Entität.
ATT&CK
CHIMBORAZO · Hive0065 · Spandex Tempest · TA505
MISP
ATK103 · CHIMBORAZO · Dudear · GOLD TAHOE · GRACEFUL SPIDER · Hive0065 · SectorJ04 · SectorJ04 Group · Spandex Tempest · TA505
TA505, the name given by Proofpoint, has been in the cybercrime business for at least four years. This is the group behind the infamous Dridex banking trojan and Locky ransomware, delivered through malicious email campaigns via Necurs botnet. Other malware associated with TA505 include Philadelphia and GlobeImposter ransomware families.
02
zugeordnete ATT&CK-Gruppen
Zugehörige Bedrohungsgruppen.
03
verwandte Akteure
Verwandte Einträge.
- MONTY SPIDER· likely
04
genutzte Techniken (34)
ATT&CK-Techniken, die dies ermöglicht oder abbildet.
20 von 34 angezeigt
05
genutzte Software (16)
Zugehörige Malware und Tools.
06
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://www.bleepingcomputer.com/news/security/ta505-group-adopts-new-servhelper-backdoor-and-flawedgrace-rat/
- https://www.proofpoint.com/sites/default/files/ta505_timeline_final4_0.png
- https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta505-dridex-globeimposter
- https://www.cybereason.com/blog/threat-actor-ta505-targets-financial-enterprises-using-lolbins-and-a-new-backdoor-malware
- https://e.cyberint.com/hubfs/Report%20Legit%20Remote%20Access%20Tools%20Turn%20Into%20Threat%20Actors%20Tools/CyberInt_Legit%20Remote%20Access%20Tools%20Turn%20Into%20Threat%20Actors'%20Tools_Report.pdf
- https://threatpost.com/ta505-servhelper-malware/140792/
- https://blog.yoroi.company/research/the-stealthy-email-stealer-in-the-ta505-arsenal/
- https://threatrecon.nshc.net/2019/08/29/sectorj04-groups-increased-activity-in-2019/