TA505

    RussiaUnknown

    Observation period

    34

    Techniques

    0

    Reports

    Latest observed activity
    No dated reports available
    First observed
    —

    Profile

    TA505, the name given by Proofpoint, has been in the cybercrime business for at least four years. This is the group behind the infamous Dridex banking trojan and Locky ransomware, delivered through malicious email campaigns via Necurs botnet. Other malware associated with TA505 include Philadelphia and GlobeImposter ransomware families.

    Relevance for Germany, Austria and Switzerland

    high

    Assessment based on target countries according to MISP Galaxy (CFR Cyber Operations Tracker).

    Target sectors according to source

    • Education
    • Finance
    • Health
    • Retail
    • Hospitality

    Target countries according to source Australia, Canada, Czech Republic, Germany, Hungary, India, Japan, Romania, Serbia, Singapore, South Korea, Spain, Thailand, Turkey, United Kingdom, United States

    Aliases

    • SectorJ04
    • SectorJ04 Group
    • GRACEFUL SPIDER
    • GOLD TAHOE
    • Dudear
    • ATK103
    • Hive0065
    • CHIMBORAZO
    • Spandex Tempest

    MITRE ATT&CK techniques

    Observed techniques per ATT&CK Enterprise and ICS. Each technique links to the ATT&CK knowledge base.

    Software / tooling used

    External references

    Back to group overview