TA505
TA505 is a cyber criminal group that has been active since at least 2014. TA505 is known for frequently changing malware, driving global trends in criminal malware distribution, and ransomware campaigns involving Clop.
- ATT&CK ID
- G0092
- Weather family
- Tempest
- Techniques
- 24
- Tools
- 16
Also tracked as Hive0065 · Spandex Tempest · CHIMBORAZO
Techniques
Resource Development
Acquire InfrastructureObtain CapabilitiesStage Capabilities
Initial Access
Execution
Command and Scripting InterpreterNative APIUser ExecutionInter-Process Communication
Persistence
Privilege Escalation
Process InjectionValid Accounts
Stealth
Obfuscated Files or InformationProcess InjectionValid AccountsDeobfuscate/Decode Files or InformationSystem Binary Proxy Execution
Defense Impairment
Modify RegistrySubvert Trust ControlsDisable or Modify Tools
Credential Access
Unsecured CredentialsCredentials from Password Stores
Discovery
Permission Groups DiscoveryAccount Discovery
Command and Control
Application Layer ProtocolIngress Tool TransferDynamic Resolution
Impact
Software
AdFind · Amadey · Azorult · BloodHound · Clop · Cobalt Strike · Dridex · FlawedAmmyy · FlawedGrace · Get2 · Mimikatz · Net · PowerSploit · SDBbot · ServHelper · TrickBot