TA505, the name given by Proofpoint, has been in the cybercrime business for at least four years. This is the group behind the infamous Dridex banking trojan and Locky ransomware, delivered through malicious email campaigns via Necurs botnet. Other malware associated with TA505 include Philadelphia and GlobeImposter ransomware families.
The same group is tracked under different names by different vendors.
| Vendor | Name |
|---|---|
| OSINT | SectorJ04 |
| OSINT | SectorJ04 Group |
| OSINT | GRACEFUL SPIDER |
| OSINT | GOLD TAHOE |
| OSINT | Dudear |
| OSINT | G0092 |
| OSINT | ATK103 |
| OSINT | Hive0065 |
| OSINT | CHIMBORAZO |
| OSINT | Spandex Tempest |
Sectors: Education, Finance, Health, Retail, Hospitality
Victim countries: Australia, Canada, Czech Republic, Germany, Hungary, India, Japan, Romania, Serbia, Singapore, South Korea, Spain, Thailand, Turkey, United Kingdom, United States
No IOCs extracted yet from reports naming this actor.
Every report in the Global Intel Library that names TA505, newest first. Open any report to see the full analysis with provenance.
No reports in the Lore library name this actor yet.
Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to TA505. Each row shows why it was linked and where it came from.
No feed indicators linked to this actor yet. Feeds are checked every hour.
Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.