TA505 is a cyber criminal group that has been active since at least 2014. TA505 is known for frequently changing malware, driving global trends in criminal malware distribution, and ransomware campaigns involving Clop.12345
- Proofpoint TA505 Sep 2017
- Proofpoint TA505 June 2018
- Proofpoint TA505 Jan 2019
- NCC Group TA505
- Korean FSI TA505 2020
断言与引用
每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。
| predicate | object | 有效期 | 置信 | 证据 |
|---|---|---|---|---|
| uses_technique | tech_t1087.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1553.005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.007 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1112 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1568.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.013 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1552.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.007 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1608.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.011 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1140 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.010 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1069 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1553.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1486 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1106 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1559.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1055.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
技术使用
| ATT&CK | 技术 | platforms |
|---|---|---|
| T1027.002 | Software Packing | — |
| T1027.010 | Command Obfuscation | — |
| T1027.013 | Encrypted/Encoded File | — |
| T1055.001 | Dynamic-link Library Injection | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1059.005 | Visual Basic | — |
| T1059.007 | JavaScript | — |
| T1069 | Permission Groups Discovery | — |
| T1071.001 | Web Protocols | — |
| T1078.002 | Domain Accounts | — |
| T1087.003 | Email Account | — |
| T1105 | Ingress Tool Transfer | — |
| T1106 | Native API | — |
| T1112 | Modify Registry | — |
| T1140 | Deobfuscate/Decode Files or Information | — |
| T1204.001 | Malicious Link | — |
| T1204.002 | Malicious File | — |
| T1218.007 | Msiexec | — |
| T1218.011 | Rundll32 | — |
| T1486 | Data Encrypted for Impact | — |
| T1552.001 | Credentials In Files | — |
| T1553.002 | Code Signing | — |
| T1553.005 | Mark-of-the-Web Bypass | — |
| T1555.003 | Credentials from Web Browsers | — |
| T1559.002 | Dynamic Data Exchange | — |
| T1566.001 | Spearphishing Attachment | — |
| T1566.002 | Spearphishing Link | — |
| T1568.001 | Fast Flux DNS | — |
| T1583.001 | Domains | — |
| T1588.001 | Malware | — |
| T1588.002 | Tool | — |
| T1608.001 | Upload Malware | — |
| T1685 | Disable or Modify Tools | — |
别名
CHIMBORAZO · Hive0065 · Spandex Tempest · TA505
读取与复核
记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。