- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Russia(high confidence)
- Motivation
- Financial crime; Financial gain
- Seen
- 2006–2026
- Status
- Active
- ATT&CK
- G0092 · 34 techniques
- Sources
- 12 sources carry it
- Identifier
- GINC-APT-0034 · ta505
RussiaWhat it is
TA505 is a cyber criminal group that has been active since at least 2014. TA505 is known for frequently changing malware, driving global trends in criminal malware distribution, and ransomware campaigns involving Clop.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Monty Spider, Graceful Spider
- Mandiant
- FIN11, TEMP.Warlock, UNC902
- Microsoft
- DEV-0950, Lace Tempest, Spandex Tempest
- MITRE ATT&CK
- G0092
- NSHC
- SectorJ04
- Thales
- ATK103
- Operations
- Operation “Cyclone”, Operation “Tovar”, Operation “Trident Breach”
- Other names
- Cl0p, GOLD EVERGREEN, GOLD RIVERVIEW, ATK 103, CHIMBORAZO, Chubby Scorpius, Clop, Dudear, Gold Tahoe, Hive0065, RAZOR COMET, SectorJ04 Group, TA505, Graceful Spider, Gold Evergreen, The Business Club
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Targets
- Countries
- Australia, Canada, Czech Republic, Germany, Hungary, India, Japan, Romania, Serbia, Singapore, South Korea, Spain, Thailand, Türkiye, United Kingdom, United States
- Sectors
- Defense, Education, Energy, Finance, Financial, Government, Health, Healthcare, Hospitality, Retail, Technology, Telecommunications, Transportation
Tools
The tools and malware families the sources tie to it.
- AdFind
- Amadey
- Archelaus Beta
- Azorult
- BLACKCOFFEE
- BlackEnergy
- BlackHole
- BlackNix
- Blackshades
- BloodHound
- Clop
- Cobalt Strike
- Cyber Eye RAT
- CyberGate
- Dridex
- FlawedAmmyy
- FlawedGrace
- Get2
- Mimikatz
- Net
- Net Crawler
- Net Devil
- P2P ZeuS
- PowerSploit
- SDBbot
- ServHelper
- TrickBot
- Trojan.Karagany
- Trojan.Mebromi
- Xploit
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de