FlagThis

← All Threat Actors
Threat Actor Profile

TA505

ATK103 CHIMBORAZO Dudear G0092 GOLD TAHOE GRACEFUL SPIDER Hive0065 SectorJ04 SectorJ04 Group Spandex Tempest
▲ High Threat
TA505, the name given by Proofpoint, has been in the cybercrime business for at least four years. This is the group behind the infamous Dridex banking trojan and Locky ransomware, delivered through malicious email campaigns via Necurs botnet. Other malware associated with TA505 include Philadelphia and GlobeImposter ransomware families.
Origin Russia

Target Sectors

Education Finance Health Retail Hospitality

Known TTPs

Email Account
Domains
Mark-of-the-Web Bypass
Msiexec
Modify Registry
Tool
Malicious File
Fast Flux DNS
Encrypted/Encoded File
Software Packing
Credentials In Files
Visual Basic
JavaScript
Malicious Link
Upload Malware
Rundll32
Deobfuscate/Decode Files or Information
Credentials from Web Browsers
Command Obfuscation
Permission Groups Discovery
Ingress Tool Transfer
Malware
Domain Accounts
Code Signing
Data Encrypted for Impact
PowerShell
Spearphishing Attachment
Native API
Spearphishing Link
Disable or Modify Tools
Dynamic Data Exchange
Dynamic-link Library Injection
Web Protocols
Windows Command Shell

External Resources

CISA Advisories ↗

Related Intelligence

Hacking the mainframe…
LINK COPIED TO CLIPBOARD