TA505
TA505 is a financially motivated threat group that has been active since at least 2014. The group is known for frequently changing malware and driving global trends in criminal malware distribution.[1][2][3]
Associated Group Descriptions
Name | Description |
---|---|
Hive0065 |
Techniques Used
Domain | ID | Name | Use | |
---|---|---|---|---|
Enterprise | T1087 | .003 | Account Discovery: Email Account |
TA505 has used the tool EmailStealer to steal and send lists of e-mail addresses to a remote server.[5] |
Enterprise | T1071 | .001 | Application Layer Protocol: Web Protocols | |
Enterprise | T1059 | .001 | Command and Scripting Interpreter: PowerShell |
TA505 has used PowerShell to download and execute malware and reconnaissance scripts.[1][6][7][8] |
.005 | Command and Scripting Interpreter: Visual Basic | |||
.007 | Command and Scripting Interpreter: JavaScript/JScript | |||
.003 | Command and Scripting Interpreter: Windows Command Shell | |||
Enterprise | T1555 | .003 | Credentials from Password Stores: Credentials from Web Browsers |
TA505 has used malware to gather credentials from Internet Explorer.[1] |
Enterprise | T1486 | Data Encrypted for Impact |
TA505 has used a wide variety of ransomware, such as Locky, Jaff, Bart, Philadelphia, and GlobeImposter, to encrypt victim files and demand a ransom payment.[1] |
|
Enterprise | T1568 | .001 | Dynamic Resolution: Fast Flux DNS |
TA505 has used fast flux to mask botnets by distributing payloads across multiple IPs.[5] |
Enterprise | T1105 | Ingress Tool Transfer |
TA505 has downloaded additional malware to execute on victim systems.[7][8][6] |
|
Enterprise | T1559 | .002 | Inter-Process Communication: Dynamic Data Exchange |
TA505 has leveraged malicious Word documents that abused DDE.[2] |
Enterprise | T1027 | Obfuscated Files or Information |
TA505 has password-protected malicious Word documents and used base64 encoded PowerShell commands.[1][7][8] |
|
.002 | Software Packing | |||
Enterprise | T1069 | Permission Groups Discovery |
TA505 has used TinyMet to enumerate members of privileged groups.[4] TA505 has also run |
|
Enterprise | T1566 | .001 | Phishing: Spearphishing Attachment |
TA505 has used spearphishing emails with malicious attachments to initially compromise victims.[1][2][3][7][6][9][5][10][4] |
.002 | Phishing: Spearphishing Link |
TA505 has sent spearphishing emails containing malicious links.[1][3][5][10] |
||
Enterprise | T1055 | .001 | Process Injection: Dynamic-link Library Injection | |
Enterprise | T1218 | .007 | Signed Binary Proxy Execution: Msiexec |
TA505 has used |
.011 | Signed Binary Proxy Execution: Rundll32 |
TA505 has leveraged |
||
Enterprise | T1553 | .002 | Subvert Trust Controls: Code Signing |
TA505 has signed payloads with code signing certificates from Thawte and Sectigo.[7][8][5] |
Enterprise | T1552 | .001 | Unsecured Credentials: Credentials In Files |
TA505 has used malware to gather credentials from FTP clients and Outlook.[1] |
Enterprise | T1204 | .002 | User Execution: Malicious File |
TA505 has used lures to get users to enable content in malicious attachments and execute malicious files contained in archives. For example, TA505 makes their malware look like legitimate Microsoft Word documents, .pdf and/or .lnk files. [1][2][3][7][6][9][5][10][4] |
.001 | User Execution: Malicious Link |
TA505 has used lures to get users to click links in emails and attachments. For example, TA505 makes their malware look like legitimate Microsoft Word documents, .pdf and/or .lnk files. [1][2][3][7][6][9][5][10] |
||
Enterprise | T1078 | .002 | Valid Accounts: Domain Accounts |
TA505 has used stolen domain admin accounts to compromise additional hosts.[4] |
Software
References
- Proofpoint Staff. (2017, September 27). Threat Actor Profile: TA505, From Dridex to GlobeImposter. Retrieved May 28, 2019.
- Proofpoint Staff. (2018, June 8). TA505 shifts with the times. Retrieved May 28, 2019.
- Schwarz, D. and Proofpoint Staff. (2019, January 9). ServHelper and FlawedGrace - New malware introduced by TA505. Retrieved May 28, 2019.
- Frydrych, M. (2020, April 14). TA505 Continues to Infect Networks With SDBbot RAT. Retrieved May 29, 2020.
- Hiroaki, H. and Lu, L. (2019, June 12). Shifting Tactics: Breaking Down TA505 Group’s Use of HTML, RATs and Other Techniques in Latest Campaigns. Retrieved May 29, 2020.
- Proofpoint Staff. (2018, July 19). TA505 Abusing SettingContent-ms within PDF files to Distribute FlawedAmmyy RAT. Retrieved April 19, 2019.
- Salem, E. (2019, April 25). Threat Actor TA505 Targets Financial Enterprises Using LOLBins and a New Backdoor Malware. Retrieved May 28, 2019.
- Vilkomir-Preisman, S. (2019, April 2). New ServHelper Variant Employs Excel 4.0 Macro to Drop Signed Payload. Retrieved May 28, 2019.
- Proofpoint Staff. (2018, March 7). Leaked Ammyy Admin Source Code Turned into Malware. Retrieved May 28, 2019.
- Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.