TA505 - G0092

Created: 2019-05-28T15:54:17.213Z

Modified: 2023-03-22T05:38:20.381Z

Contributors:

Aliases

TA505,Hive0065

Description

TA505 is a cyber criminal group that has been active since at least 2014. TA505 is known for frequently changing malware, driving global trends in criminal malware distribution, and ransomware campaigns involving Clop.(Citation: Proofpoint TA505 Sep 2017)(Citation: Proofpoint TA505 June 2018)(Citation: Proofpoint TA505 Jan 2019)(Citation: NCC Group TA505)(Citation: Korean FSI TA505 2020)

Techniques Used

TA505 has used base64 encoded PowerShell commands.(Citation: Cybereason TA505 April 2019)(Citation: Deep Instinct TA505 Apr 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Containers,IaaS|T1562.001|Disable or Modify Tools|

TA505 has used malware to disable Windows Defender.(Citation: Korean FSI TA505 2020)|
|mitre-attack|enterprise-attack|PRE|T1608.001|Upload Malware|

TA505 has staged malware on actor-controlled domains.(Citation: Korean FSI TA505 2020)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1106|Native API|

TA505 has deployed payloads that use Windows API calls on a compromised host.(Citation: Korean FSI TA505 2020)|
|mitre-attack|enterprise-attack|PRE|T1588.001|Malware|

TA505 has used malware such as

Azorult and

Cobalt Strike in their operations.(Citation: NCC Group TA505)|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|

TA505 has used a variety of tools in their operations, including

AdFind,

BloodHound,

Mimikatz, and