modified: 2024-04-10T22:37:02.592Z
name: TA505
description: [TA505](https://attack.mitre.org/groups/G0092) is a cyber criminal group that has been active since at least 2014. [TA505](https://attack.mitre.org/groups/G0092) is known for frequently changing malware, driving global trends in criminal malware distribution, and ransomware campaigns involving [Clop](https://attack.mitre.org/software/S0611).(Citation: Proofpoint TA505 Sep 2017)(Citation: Proofpoint TA505 June 2018)(Citation: Proofpoint TA505 Jan 2019)(Citation: NCC Group TA505)(Citation: Korean FSI TA505 2020)
aliases: TA505
Hive0065
Spandex Tempest
CHIMBORAZO
x_mitre_deprecated: no
x_mitre_version: 3.0
type: intrusion-set
spec_version: 2.1
id: intrusion-set--7eda3dd8-b09b-4705-8090-c2ad9fb8c14d
created: 2019-05-28T15:54:17.213Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0092
external_id: G0092
source_name: Hive0065
description: (Citation: IBM TA505 April 2020)
source_name: Spandex Tempest
description: (Citation: Microsoft Threat Actor Naming July 2023)
source_name: CHIMBORAZO
description: (Citation: Microsoft Threat Actor Naming July 2023)
source_name: Korean FSI TA505 2020
description: Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.
url: https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory=
source_name: IBM TA505 April 2020
description: Frydrych, M. (2020, April 14). TA505 Continues to Infect Networks With SDBbot RAT. Retrieved May 29, 2020.
url: https://securityintelligence.com/posts/ta505-continues-to-infect-networks-with-sdbbot-rat/
source_name: Microsoft Threat Actor Naming July 2023
description: Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.
url: https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide
source_name: Proofpoint TA505 Sep 2017
description: Proofpoint Staff. (2017, September 27). Threat Actor Profile: TA505, From Dridex to GlobeImposter. Retrieved May 28, 2019.
url: https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta505-dridex-globeimposter
source_name: Proofpoint TA505 June 2018
description: Proofpoint Staff. (2018, June 8). TA505 shifts with the times. Retrieved May 28, 2019.
url: https://www.proofpoint.com/us/threat-insight/post/ta505-shifts-times
source_name: Proofpoint TA505 Jan 2019
description: Schwarz, D. and Proofpoint Staff. (2019, January 9). ServHelper and FlawedGrace - New malware introduced by TA505. Retrieved May 28, 2019.
url: https://www.proofpoint.com/us/threat-insight/post/servhelper-and-flawedgrace-new-malware-introduced-ta505
source_name: NCC Group TA505
description: Terefos, A. (2020, November 18). TA505: A Brief History of Their Time. Retrieved July 14, 2022.
url: https://research.nccgroup.com/2020/11/18/ta505-a-brief-history-of-their-time/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5