threat actor

TA505

unknownentity:threat_actor

TA505, the name given by Proofpoint, has been in the cybercrime business for at least four years. This is the group behind the infamous Dridex banking trojan and Locky ransomware, delivered through malicious email campaigns via Necurs botnet. Other malware associated with TA505 include Philadelphia and GlobeImposter ransomware families.

Curated · btcintel

claims we make, each with its source and citation · sources may contradict; we show the set, never a score

Facts

id: ta505
kind: threat actor
status: unknown
aliases: ATK103 · CHIMBORAZO · Dudear · G0092 · GOLD TAHOE · GRACEFUL SPIDER · Hive0065 · MONTY SPIDER · SectorJ04 · SectorJ04 Group · Spandex Tempest
jurisdictions: —
claims naming it: 0 · 0 attributions · 11 relations · 0 events

Identifiers

attack G0092via mitre-attack
misp-galaxy 03c80674-35f8-4fe0-be2b-226ed0fcd69fvia misp-galaxy-threat-actor
misp-galaxy 168a9e38-70e3-4542-b78f-afa2414436bbvia misp-galaxy-threat-actor

Relations

MITRE ATT&CK Enterpriserecords thatTA505usesClop
fetch —sha256 dc1639caa5501d72
rel_364btcintel:relations:364@v1 sha256:8da35fbf253f3f36
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatTA505usesAzorult
fetch —sha256 dc1639caa5501d72
rel_365btcintel:relations:365@v1 sha256:87c648eff6aab513
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatTA505usesFlawedAmmyy
fetch —sha256 dc1639caa5501d72
rel_366btcintel:relations:366@v1 sha256:88afef44b22a929a
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatTA505usesDridex
fetch —sha256 dc1639caa5501d72
rel_367btcintel:relations:367@v1 sha256:49ca5f4c0e7b5886
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatTA505usesTrickBot
fetch —sha256 dc1639caa5501d72
rel_368btcintel:relations:368@v1 sha256:fa4d6498dc7f4f02
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatTA505usesGet2
fetch —sha256 dc1639caa5501d72
rel_369btcintel:relations:369@v1 sha256:3040d096cf271296
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatTA505usesFlawedGrace
fetch —sha256 dc1639caa5501d72
rel_370btcintel:relations:370@v1 sha256:5484188c691cbe8c
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatTA505usesCobalt Strike
fetch —sha256 dc1639caa5501d72
rel_371btcintel:relations:371@v1 sha256:4fc53068054d1031
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatTA505usesServHelper
fetch —sha256 dc1639caa5501d72
rel_372btcintel:relations:372@v1 sha256:dec003e09ef83efb
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatTA505usesAmadey
fetch —sha256 dc1639caa5501d72
rel_373btcintel:relations:373@v1 sha256:c4395ad0a8de7665
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatTA505usesSDBbot
fetch —sha256 dc1639caa5501d72
rel_374btcintel:relations:374@v1 sha256:466c33a1c18a753d
confidenceauthority data · 60

Events

computedno dated events recorded for this entity

Claims naming this entity

computedno current claim names this entity

Subjects0 subjects carry a claim naming this entity · a sample

computedno subject carries a claim naming this entity

Community

notes from Nostr labelers · never merged with the bands above · not endorsed

Community content is indexed from Nostr and not endorsed by btcintel.

not computed yetNot indexed yet: the community index has not looked at this subject.