TA505Threat actor
- atk103
- chimborazo
- dudear
- g0092
- gold tahoe
- graceful spider
- hive0065
- sectorj04
- sectorj04 group
TA505, the name given by Proofpoint, has been in the cybercrime business for at least four years. This is the group behind the infamous Dridex banking trojan and Locky ransomware, delivered through malicious email campaigns via Necurs botnet. Other malware associated with TA505 include Philadelphia and GlobeImposter ransomware families.From MISP Galaxy
Last reported 4 months ago, by Sekoia.io5 reports
ATT&CK techniques
6 of 26 · each with the sentence it comes from- T1005Data from Local System
“Data from Local System”
- T1021.001Remote Desktop Protocol
“…unauthorised access into networks and systems, often through phishing attacks, exploitation of vulnerabilities, or compromising Remote Desktop Protocols (RDP).”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Dynamic API Resolution”
- T1027.007Dynamic API Resolution
“Dynamic API resolution”
- T1033System Owner/User Discovery
“System Owner/User Discovery”
- T1036Masquerading
“T1036.004 - Masquerading: Masquerade Task or Service”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
Cyber Threat Actors Impacting the Financial Sector in 2024“First identified in December 2024, this campaign was claimed by TA505, a well-established intrusion set known to deploy the Cl0p ransomware, that engaged in post-exploitation activity.”
-
Critical Vulnerability: SysAid CVE-2023-47246“Days prior, Microsoft had notified SysAid of this issue and that they attributed these compromises to TA505 “Lace Tempest”, often known as the cl0p ransomware gang.”
-
Elastic Security Labs discovers the LOBSHOT malware“Throughout our analysis, we observed infrastructure known to belong to TA505.”
-
Critical Vulnerabilities in PaperCut Print Management Software“Truebot is linked to an entity known as Silence, which in turn has historical links with the ransomware-related entity TA505 (or Clop).”
-
Investigating Intrusions From Intriguing Exploits“While links are not authoritative, analysis of Truebot activity and deployment mechanisms indicate links to a group referred to as TA505.”
Indicators in its reports
named in the reports above- okta-revolut[.]comin 1 report
- revolut-okta[.]comin 1 report
- hxxp://upd488.windowservicecemter[.]com/download/setup.msiin 1 report
- upd488.windowservicecemter[.]comin 1 report
- f9947c5763542b31…42641983aabbin 1 report
- gmx[.]comin 1 report
- windowservicecemter[.]comin 1 report
- c0f8aeeb2d11c6e7…8738b6cc4125in 1 report
- anydeskupdate[.]comin 1 report
- anydeskupdates[.]comin 1 report
- netviewremote[.]comin 1 report
- updateservicecenter[.]comin 1 report
- windowcsupdates[.]comin 1 report
- windowservicecentar[.]comin 1 report
- windowservicecenter[.]comin 1 report
- winserverupdates[.]comin 1 report
- hxxp://50.19.48[.]59:82/me1.batin 1 report
- 50.19.48[.]59in 1 report
- hxxp://50.19.48[.]59:82/me2.batin 1 report
Copy these 19 indicators · defanged
Thanks — we review every report.