Introduction
TA505, the name given by Proofpoint, has been in the cybercrime business for at least four years. This is the group behind the infamous Dridex banking trojan and Locky ransomware, delivered through malicious email campaigns via Necurs botnet. Other malware associated with TA505 include Philadelphia and GlobeImposter ransomware families.
Activities and Tactics
Targeted Sectors: Education, Finance, Health, Retail, Hospitality
Country of Origin: 🇷🇺 Russia
Suspected Victims: Australia, Canada, Czech Republic, Germany, Hungary, India, Japan, Romania, Serbia, Singapore…
Notable Campaigns
Information pending cataloguing.
Tactics, Techniques, and Procedures (TTPs)
- T1087.003 Email Account
- T1583.001 Domains
- T1553.005 Mark-of-the-Web Bypass
- T1218.007 Msiexec
- T1112 Modify Registry
- T1588.002 Tool
- T1204.002 Malicious File
- T1568.001 Fast Flux DNS
- T1027.013 Encrypted/Encoded File
- T1027.002 Software Packing
- T1552.001 Credentials In Files
- T1059.005 Visual Basic
- T1059.007 JavaScript
- T1204.001 Malicious Link
- T1608.001 Upload Malware
- T1218.011 Rundll32
- T1140 Deobfuscate/Decode Files or Information
- T1555.003 Credentials from Web Browsers
- T1027.010 Command Obfuscation
- T1069 Permission Groups Discovery
- T1105 Ingress Tool Transfer
- T1588.001 Malware
- T1078.002 Domain Accounts
- T1553.002 Code Signing
- T1486 Data Encrypted for Impact
- T1059.001 PowerShell
- T1566.001 Spearphishing Attachment
- T1106 Native API
- T1566.002 Spearphishing Link
- T1685 Disable or Modify Tools
- T1559.002 Dynamic Data Exchange
- T1055.001 Dynamic-link Library Injection
- T1071.001 Web Protocols
- T1059.003 Windows Command Shell
ATT&CK technique IDs (denormalized)
- T1027.002
- T1027.010
- T1027.013
- T1055.001
- T1059.001
- T1059.003
- T1059.005
- T1059.007
- T1069
- T1071.001
- T1078.002
- T1087.003
- T1105
- T1106
- T1112
- T1140
- T1204.001
- T1204.002
- T1218.007
- T1218.011
- T1486
- T1552.001
- T1553.002
- T1553.005
- T1555.003
- T1559.002
- T1566.001
- T1566.002
- T1568.001
- T1583.001
- T1588.001
- T1588.002
- T1608.001
- T1685
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
- Trojan.Karagany
- Trojan.Mebromi
- CyberGate
- Cyber Eye RAT
MITRE ATT&CK Software
- AdFind (S0552) — tool
- Clop (S0611) — malware
- Azorult (S0344) — malware
- FlawedAmmyy (S0381) — malware
- Mimikatz (S0002) — tool
- Dridex (S0384) — malware
- TrickBot (S0266) — malware
- Get2 (S0460) — malware
- FlawedGrace (S0383) — malware
- Cobalt Strike (S0154) — malware
- ServHelper (S0382) — malware
- BloodHound (S0521) — tool
- Amadey (S1025) — malware
- SDBbot (S0461) — malware
- Net (S0039) — tool
- PowerSploit (S0194) — tool
Attribution and Evidence
Country of Origin: Russia Additional attribution information pending cataloguing.
References
[1] mitre-attack [5] Korean FSI TA505 2020 Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022. [6] IBM TA505 April 2020 Frydrych, M. (2020, April 14). TA505 Continues to Infect Networks With SDBbot RAT. Retrieved May 29, 2020. [7] Microsoft Threat Actor Naming July 2023 Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023. [8] Proofpoint TA505 Sep 2017 Proofpoint Staff. (2017, September 27). Threat Actor Profile: TA505, From Dridex to GlobeImposter. Retrieved May 28, 2019. [9] Proofpoint TA505 June 2018 Proofpoint Staff. (2018, June 8). TA505 shifts with the times. Retrieved May 28, 2019. [10] Proofpoint TA505 Jan 2019 Schwarz, D. and Proofpoint Staff. (2019, January 9). ServHelper and FlawedGrace - New malware introduced by TA505. Retrieved May 28, 2019. [11] NCC Group TA505 Terefos, A. (2020, November 18). TA505: A Brief History of Their Time. Retrieved July 14, 2022.