TA505· Russia

TA505 (SectorJ04) is a financially motivated cybercrime group known for Dridex banking trojan and Locky ransomware.

Analyst brief

TA505 (a.k.a. SectorJ04, GOLD TAHOE) is a financially motivated cybercrime group known for operating Dridex banking trojan and Locky ransomware. This actor targets the finance, education, healthcare, retail, and hospitality sectors globally. They utilize spearphishing attachments for initial access, deploy tools like Cobalt Strike and TrickBot, and deliver Clop ransomware while using Fast Flux DNS for C2 resilience. Defenders should focus on email security, monitor for Msiexec abuse, and investigate suspicious domain resolution patterns.

TA505

SectorJ04SectorJ04 GroupGRACEFUL SPIDER

unknown

TA505, the name given by Proofpoint, has been in the cybercrime business for at least four years. This is the group behind the infamous Dridex banking trojan and Locky ransomware, delivered through malicious email campaigns via Necurs botnet. Other malware associated with TA505 include Philadelphia and GlobeImposter ransomware families.

origin (suspected)

Russia

target countries (as stated by the source)

AustraliaCanadaCzech RepublicGermany

target sectors

EducationFinanceHealthRetail

techniques · ATT&CK

Domains Tool Spearphishing Attachment Visual Basic Malicious File Encrypted/Encoded File Msiexec Credentials In Files+8

malware

Clop Azorult FlawedAmmyy Dridex TrickBot Get2+10

source: misp-galaxy + mitre-attackG0092 25 refs →

Kill-chain playbook9

01
Resource Development
T1583.001 T1588.002
Monitor for suspicious domain registration and tool acquisition activities.
02
Initial Access
T1566.001
Implement user awareness training and email security controls against spearphishing emails with suspicious attachments.
03
Execution
T1059.005 T1204.002
Monitor and prevent Visual Basic execution and execution of suspicious files.
04
Stealth
T1027.013 T1218.007
Monitor for encrypted/encoded files and unusual Msiexec usage.
05
Credential Access
T1552.001 T1555.003
Restrict and monitor access to credentials stored in files and web browsers.
06
Discovery
T1069 T1087.003
Monitor for permission groups discovery and email account discovery activities.
07
Command and Control
T1105 T1568.001
Monitor for suspicious Ingress Tool Transfer and Fast Flux DNS activities.
08
Defense Impairment
T1112 T1553.005
Monitor and prevent registry modifications and Mark-of-the-Web Bypass attempts.
09
Impact
T1486
Monitor for data encrypted for impact and implement data backup procedures.

FAQ2

What method does the TA505 group use for initial access?

The TA505 group uses spearphishing attachments for initial access.

What technique does TA505 use to hide its C2 communications?

The TA505 group uses Fast Flux DNS to hide its C2 communications.

TA505· Russia

Analyst brief

TA505

Kill-chain playbook9

Resource Development

Initial Access

Execution

Stealth

Credential Access

Discovery

Command and Control

Defense Impairment

Impact

FAQ2

See also5

TA505· Russia

Analyst brief

TA505

Kill-chain playbook9

Resource Development

Initial Access

Execution

Stealth

Credential Access

Discovery

Command and Control

Defense Impairment

Impact

FAQ2

See also5