TA505
threat actorRU01
also known as
Other names and identifiers for this entity.
ATT&CK
CHIMBORAZO · Hive0065 · Spandex Tempest · TA505
MISP
ATK103 · CHIMBORAZO · Dudear · GOLD TAHOE · GRACEFUL SPIDER · Hive0065 · SectorJ04 · SectorJ04 Group · Spandex Tempest · TA505
TA505, the name given by Proofpoint, has been in the cybercrime business for at least four years. This is the group behind the infamous Dridex banking trojan and Locky ransomware, delivered through malicious email campaigns via Necurs botnet. Other malware associated with TA505 include Philadelphia and GlobeImposter ransomware families.
02
resolved ATT&CK groups
Threat groups associated with this.
03
related actors
Related entries.
- MONTY SPIDER· likely
04
techniques used (34)
ATT&CK techniques this enables or maps to.
showing 20 of 34
05
software used (16)
Malware and tools associated with this.
06
references
External citations — patches, advisories, analysis.
- https://www.bleepingcomputer.com/news/security/ta505-group-adopts-new-servhelper-backdoor-and-flawedgrace-rat/
- https://www.proofpoint.com/sites/default/files/ta505_timeline_final4_0.png
- https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta505-dridex-globeimposter
- https://www.cybereason.com/blog/threat-actor-ta505-targets-financial-enterprises-using-lolbins-and-a-new-backdoor-malware
- https://e.cyberint.com/hubfs/Report%20Legit%20Remote%20Access%20Tools%20Turn%20Into%20Threat%20Actors%20Tools/CyberInt_Legit%20Remote%20Access%20Tools%20Turn%20Into%20Threat%20Actors'%20Tools_Report.pdf
- https://threatpost.com/ta505-servhelper-malware/140792/
- https://blog.yoroi.company/research/the-stealthy-email-stealer-in-the-ta505-arsenal/
- https://threatrecon.nshc.net/2019/08/29/sectorj04-groups-increased-activity-in-2019/