TA505
Also known as: Hive0065, Spandex Tempest, CHIMBORAZO
TA505 is known for running some of the largest malicious spam campaigns ever observed, distributing banking trojans and ransomware at enormous scale, and for frequently switching malware families. It is closely associated with CL0P ransomware operations.
- Public attribution
- A cybercriminal group (MITRE ATT&CK); CISA notes the CL0P ransomware gang is also known as TA505.
- Active since
- Around 2014
- Targets
- Organisations worldwide through mass email campaigns
- Retail, finance and many other sectors
Notable campaigns
2015-2016Dridex and Locky distribution
Proofpoint reports TA505 was behind many Dridex campaigns in 2015 and introduced Locky ransomware in 2016.
2019 onwardCL0P ransomware
Ransomware campaigns involving CL0P (MITRE ATT&CK); see the Cl0p profile.
Signature ATT&CK techniques
- T1566.001Phishing: Spearphishing Attachment
- T1566.002Phishing: Spearphishing Link
- T1204.002User Execution: Malicious File
- T1059.001Command and Scripting Interpreter: PowerShell
- T1218.007System Binary Proxy Execution: Msiexec
- T1553.002Subvert Trust Controls: Code Signing
- T1486Data Encrypted for Impact
Selected from the group's MITRE ATT&CK entry, plus initial-access techniques named in the cited advisories.
Defences that work against this actor
- Strip or sandbox risky attachment types (macros, scripts, HTML, archives) at the mail gateway.
- Alert on msiexec and other system binaries fetching installers from the internet.
- Do not trust code-signing alone; criminal groups sign malware with stolen or purchased certificates.