Cyber threats / Threat actors

TA505

RU Suspected sponsor: Russia · ATT&CK G0092
6
APAC targets
34
Techniques
0
Incidents
0
News · 30d
Profile
Also known as: ATK103, CHIMBORAZO, Dudear, G0092, GOLD TAHOE, GRACEFUL SPIDER, Hive0065, SectorJ04, SectorJ04 Group, Spandex Tempest

TA505, the name given by Proofpoint, has been in the cybercrime business for at least four years. This is the group behind the infamous Dridex banking trojan and Locky ransomware, delivered through malicious email campaigns via Necurs botnet. Other malware associated with TA505 include Philadelphia and GlobeImposter ransomware families.

ATT&CK techniques · 34
Resource Development
Initial Access
Execution
Persistence
Privilege Escalation
Stealth
Defense Impairment
Credential Access
Discovery
Command and Control
Impact
Incidents attributed
  • No incident in the register is attributed to this actor.
In the news
  • No Asia-Pacific article names this actor yet.
Targets
Elsewhere: Canada, Czechia, Germany, Spain, United Kingdom, Hungary, Romania, Serbia, Türkiye, United States
Sectors: Education, Finance, Health, Hospitality, Retail
Relevance to the EU
EU relevance: High
Targets EU member states (Czechia, Germany, Spain, Hungary and 1 more) as well as 6 Asia-Pacific countries
36 EU cooperation projects in the Asia-Pacific countries this actor targets:
Trade & Investment
9
Research & Innovation
5
Infrastructure & Transport
5
Digital & ICT
4
Development Cooperation
4
Peace & Security
2
Governance & Rule of Law
2
Education & Skills
2
Threats to the EU →
References
Sources: MISP, MITRE