G0092 · 34 ATT&CK techniques · 0 correlated reports

TA505

Aliases: Hive0065, Spandex Tempest, CHIMBORAZO

TA505 is a cyber criminal group that has been active since at least 2014. TA505 is known for frequently changing malware, driving global trends in criminal malware distribution, and ransomware campaigns involving Clop.

Open interactive actor investigation

ATT&CK techniques

T1087.003
Email Account T1583.001
Domains T1553.005
Mark-of-the-Web Bypass T1218.007
Msiexec T1112
Modify Registry T1588.002
Tool T1204.002
Malicious File T1568.001
Fast Flux DNS T1027.013
Encrypted/Encoded File T1027.002
Software Packing T1552.001
Credentials In Files T1059.005
Visual Basic T1059.007
JavaScript T1204.001
Malicious Link T1562.001
Disable or Modify Tools T1608.001
Upload Malware T1218.011
Rundll32 T1140
Deobfuscate/Decode Files or Information T1555.003
Credentials from Web Browsers T1027.010
Command Obfuscation T1069
Permission Groups Discovery T1105
Ingress Tool Transfer T1588.001
Malware T1078.002
Domain Accounts T1553.002
Code Signing T1486
Data Encrypted for Impact T1059.001
PowerShell T1566.001
Spearphishing Attachment T1106
Native API T1566.002
Spearphishing Link T1559.002
Dynamic Data Exchange T1055.001
Dynamic-link Library Injection T1071.001
Web Protocols T1059.003
Windows Command Shell

Correlated CTI and IR reports

Continue the investigation

Interactive ThreatMapper ThreatMapper documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas ITDR Handbook 1200km Medium research