Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · TA505 · Unknown · assessed origin Russia · misp-galaxy + mitre-attack · refreshed 2026-10-06

TA505

  • SectorJ04
  • SectorJ04 Group
  • GRACEFUL SPIDER
  • GOLD TAHOE
  • Dudear
  • G0092
  • ATK103
  • Hive0065

MITRE G0092 ↗

TA505 — ATT&CK roseTA

attack rose · 34 techniques across 9 tactics

Analyst brief

misp-galaxy + mitre-attack

TA505, the name given by Proofpoint, has been in the cybercrime business for at least four years. This is the group behind the infamous Dridex banking trojan and Locky ransomware, delivered through malicious email campaigns via Necurs botnet. Other malware associated with TA505 include Philadelphia and GlobeImposter ransomware families.

Observed targets (as stated by the sources)

16 countries · 5 sectors
AustraliaCanadaCzechiaGermanyHungaryIndiaJapanRomaniaSerbiaSingaporeSouth KoreaSpainThailandTürkiyeUnited KingdomUnited StatesAssessed origin: Russia

assessed origin · Russiaobserved targets · 16

countries · 16

  • Australia
  • Canada
  • Czechia
  • Germany
  • Hungary
  • India
  • Japan
  • Romania
  • Serbia
  • Singapore
  • South Korea
  • Spain
  • Thailand
  • Türkiye
  • United Kingdom
  • United States

sectors · 5

  • Education
  • Finance
  • Health
  • Retail
  • Hospitality

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

34 techniques · 9 of 15 tactics

  1. Resource development

    4 techniques

  2. Initial access

    2 techniques

  3. Execution

    8 techniques

  4. Stealth

    8 techniques

  5. Defense impairment

    4 techniques

  6. Credential access

    2 techniques

  7. Discovery

    2 techniques

  8. Command and control

    3 techniques

  9. Impact

    1 technique

select a technique

Arsenal

11 malware · 5 tools
Malware
Malware · 11ATT&CK
ClopS0611 ↗
AzorultS0344 ↗
FlawedAmmyyS0381 ↗
DridexS0384 ↗
TrickBotS0266 ↗
Get2S0460 ↗
FlawedGraceS0383 ↗
Cobalt StrikeS0154 ↗
ServHelperS0382 ↗
AmadeyS1025 ↗
SDBbotS0461 ↗
Tools
Tools · 5ATT&CK
AdFindS0552 ↗
MimikatzS0002 ↗
BloodHoundS0521 ↗
NetS0039 ↗
PowerSploitS0194 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs TA505 is cited as using in a campaign

none on KEV
  1. CVE-2020-14722026-10-17
    1. “Microsoft’s Security Intelligence team noted a new campaign leveraging CVE-2020-1472 originating from a threat actor known as CHIMBORAZO, also known as TA505 , a financially motivated nation-state actor.”

      cited as used in a campaign · source: tenable.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

25 sources
  1. 1.bleepingcomputer.com/news/security/ta505-group-adopts-new-servhelper-backdo…
  2. 2.proofpoint.com/sites/default/files/ta505_timeline_final4_0.png
  3. 3.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta505-drid…
  4. 4.cybereason.com/blog/threat-actor-ta505-targets-financial-enterprises-…
  5. 5.e.cyberint.com/hubfs/Report%20Legit%20Remote%20Access%20Tools%20Turn%…
  6. 6.threatpost.com/ta505-servhelper-malware/140792
  7. 7.blog.yoroi.company/research/the-stealthy-email-stealer-in-the-ta505-arsen…
  8. 8.threatrecon.nshc.net/2019/08/29/sectorj04-groups-increased-activity-in-2019
  9. 9.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-re…
  10. 10.blueliv.com/cyber-security-and-cyber-threat-intelligence-blog-blue…
  11. +15 more in the JSON record

Track TA505 on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.