Home/Threat Actor/TA505
Threat Actor

TA505

ta505 · russia_speaking_organized_cybercrime · active since 2014

TA505 (also tracked as Spandex Tempest [formerly CHIMBORAZO], IBM Hive0065, MITRE G0092, Group-IB Graceful Spider) is a Russia-speaking organized cyber-criminal cluster financially- motivated and operationally productive since at least 2014, driving multiple global criminal-malware-distribution trends across five operational phases: the Necurs-Dridex-Locky mass- malspam era (2014-2017, peak ~38-70% of global malspam), payload diversification (2018), persistent-access backdoor era (2018-2020: ServHelper, FlawedAmmyy, FlawedGrace, SDBbot, Get2), the Clop ransomware flagship era (2019-present; operations curated separately as cl0p.yaml), and the managed- file-transfer software mass-compromise era (Accellion FTA Dec 2020 - Jan 2021.

GoAnywhere MFT Jan-Feb 2023.

MOVEit Transfer May-Jul 2023, over 2,500 victim organizations including BBC, British Airways, US Department of Energy, multiple Fortune 500, one of the largest single ransomware- operator data-breach campaigns in history)

prompted CISA/FBI AA23-158A joint advisory and US Department of State $10M Rewards for Justice bounty (July 2024).

russia_speaking_organized_cybercrime confidence: high 14 aliases MITRE ATT&CK G0092 ↗

Profile

TA505 (also tracked as Proofpoint TA505, MITRE G0092, Microsoft Spandex Tempest [formerly CHIMBORAZO], IBM X-Force Hive0065, Group-IB Graceful Spider, and historically as a spin-off from or successor to the broader "Business Club" / "Dridex Group" cluster) is one of the most operationally consequential and longest-running Russia-speaking organized cyber-criminal clusters of the modern era, financially- motivated, active publicly since at least 2014 and continuing through the present. The cluster has driven multiple global trends in criminal malware distribution and has been operationally responsible for hundreds of millions of dollars in banking-credential-theft fraud and ransomware extortion across a longitudinal operational history spanning approximately a decade. Operationally TA505 is best understood as an umbrella cluster rather than a single tightly-coupled criminal team, industry vendor naming reflects this with multiple simultaneously-applicable tracking labels, partial-overlap- not-identity relationships to adjacent clusters (most notably FIN11 / Mandiant), and operational pattern of operating multiple distinct malware families and operations under approximately the same operator membership over the cluster's tracked lifespan.

The cluster's operational signature is rapid adaptation: TA505 has changed primary malware payload families, primary distribution infrastructure, primary operational TTPs, and primary targeting focus multiple times across its decade-plus operational history while maintaining consistent operator membership and continuity of underlying operational capability. The cluster's operational phases (each operationally distinct but operator-membership-overlapping): (1) NECURS / DRIDEX / LOCKY MASS-MALSPAM ERA (2014-2017): Operationally-foundational era. TA505 leveraged the Necurs spam botnet, one of the largest spam botnets ever observed, to distribute the Dridex banking trojan (signature 2014-2017) and Locky ransomware (signature 2016-2017) at unprecedented scale, with peak operational tempo representing approximately 38-70 percent of all global malicious email volume.

The Dridex banking trojan drove hundreds of millions of dollars in banking-credential-theft and account-takeover fraud. Locky ransomware became one of the defining ransomware families of the 2016-2017 era. The cluster also operated Jaff ransomware (mid-2017), The Trick banking trojan distribution (2017-2018), and GlobeImposter ransomware mass distribution (late 2017, 24 of 34 campaigns in December 2017 distributed GlobeImposter).

(2) PAYLOAD DIVERSIFICATION ERA (2018): Operational shift from mass-malspam-distribution to payload diversity. Campaign frequency and email-message volume declined from 2017 peak while diversity of payloads increased. The cluster experimented with FlawedAmmyy RAT (developed from leaked Ammyy Admin source code), GandCrab ransomware distribution, Quant Loader, and BlackTDS infrastructure.

The 2018 era marked the cluster's operational maturation from banking-trojan-and-mass-ransomware operations toward more targeted financial-sector intrusions with longer dwell time and higher-value individual operations. (3) PERSISTENT-ACCESS-FOCUSED BACKDOOR ERA (2018-2020): November 2018 introduction of the ServHelper backdoor marked transition to persistent-access-focused tooling for longer- dwell intrusions. ServHelper (with "tunnel" and "downloader" variants), FlawedGrace RAT, FlawedAmmyy RAT, and the newly-developed SDBbot RAT (October 2019, exclusive-to-TA505 malware family) became the cluster's signature 2018-2020 tooling.

The cluster also operated the Get2 downloader, the AndroMut loader, the MirrorBlast loader, and various commodity stealers (Predator The Thief, KPOT, Pony, EmailStealer). The era represented the cluster's operational transition from mass- distribution-focused tradecraft toward hands-on-keyboard intrusion tradecraft. (4) CLOP RANSOMWARE FLAGSHIP ERA (2019-PRESENT): Operationally the cluster's modern flagship operation.

TA505 began distributing the Clop ransomware family in early 2019 (Clop evolved from the CryptoMix ransomware lineage) with operational expansion through 2020. Clop became TA505's flagship ransomware operation from 2020 onward and transitioned the cluster to big-game-hunting model with data-theft-and- extortion-before-encryption ("double extortion") against large-enterprise victims. ANSSI's August 2020 CERTFR-2020-CTI-009 report provides canonical French-government technical attribution of the TA505-Clop link via shared code-signing certificates (Clop and FlawedAmmyy historically signed by same valid-but-malicious security certificates), shared compilation environments, and shared post-compromise tradecraft patterns.

The Clop ransomware operations are curated as a separate operational profile in this corpus (cl0p.yaml); TA505 (this YAML) is the broader umbrella cluster of which Clop is the modern flagship operation.

(5) MANAGED-FILE-TRANSFER MASS COMPROMISE ERA (2020-2023): The Clop operation under TA505 umbrella has executed three operationally-significant managed-file-transfer-software mass-compromise campaigns: the December 2020
  • January 2021 Accellion FTA campaign (CVE-2021-27101 through CVE-2021-27104, DEWMODE web shell, dozens of victims including Jones Day, Kroger, Singtel, University of Colorado, Reserve Bank of New Zealand); the January-February 2023 GoAnywhere MFT campaign (CVE-2023-0669, approximately 130 victims including Procter & Gamble, Saks Fifth Avenue, City of Toronto, Hitachi Energy, Rio Tinto); and the May-July 2023 MOVEit Transfer mass- compromise campaign (CVE-2023-34362, LEMURLOOT web shell, over 2,500 victim organizations posted to Clop data-leak site including BBC, British Airways, Boots, US Department of Energy, multiple US state agencies, multiple US universities, Shell, PwC, Ernst & Young, many additional Fortune 500 organizations). The MOVEit Transfer campaign is one of the largest single ransomware-operator data-breach campaigns in history and prompted the CISA/FBI/partner AA23-158A joint advisory (June 7, 2023) and the subsequent US Department of State $10 million Rewards for Justice bounty (July 11, 2024). Targeting profile across the cluster's operational history is consistently focused on financial services (banks, insurance, payment processors, fintech) as the primary sector, with strong secondary targeting against retail/e-commerce (payment card and customer account data), healthcare (high- sensitivity data, traditionally-constrained cybersecurity budgets), enterprise technology companies (particularly managed-file-transfer software vendors), hospitality and restaurants, and increasingly state-and-local-government organizations through the modern Clop ransomware era. The cluster's victims span the United States, United Kingdom, Canada, France, Germany, Italy, Spain, the Netherlands, Belgium, Switzerland, Australia, South Korea, Japan, Mexico, Brazil, Colombia, Hungary, and broader Western and Asia- Pacific economies. Consistent victimology avoidance of Commonwealth of Independent States countries is operationally visible across both Necurs-era mass-malspam operations (CIS countries excluded from targeting lists) and modern Clop ransomware operations (CIS-language-exclusion check in ransomware payloads). The CIS-exclusion victimology pattern is the strongest consistent operator-geolocation indicator. No formal state-actor attribution has been asserted by any government cybersecurity authority. The cluster is consistently tracked as an organized-cybercrime actor operating from Russia-speaking jurisdictions almost certainly Russia or adjacent CIS countries, with operational behaviors consistent with the broader Russia-speaking-organized-cybercrime ecosystem and observed cluster genealogical adjacency to "Business Club" / "Dridex Group" predecessors and FIN11 contemporaries. The US Department of State's July 2024 $10 million Rewards for Justice bounty represents the highest- tier US-government formal-attribution response to the cluster's Clop operations to date. The TA505 cluster is operationally significant as one of the defining longitudinal-operational-continuity examples in the modern Russia-speaking-organized-cybercrime ransomware ecosystem. The cluster's approximately decade-long operational lifespan, its multi-phase operational evolution, its driving of multiple global trends in criminal malware distribution (Necurs-mass-malspam, Dridex-banking-trojan, Locky-and- GlobeImposter-ransomware-mass-distribution, FlawedAmmyy-RAT- via-leaked-source, ServHelper-and-SDBbot-persistent-access, Clop-double-extortion-big-game-hunting, managed-file-transfer- software-mass-compromise), and its operational productivity across approximately a decade of tracked operations make the cluster one of the highest-impact organized-cybercrime actors in modern cyber-threat-intelligence history.

Aliases

14
ta505ta-505g0092spandex tempestspandextempestchimborazohive0065hive-0065fin11_overlapdridex_group_offshootta505 / chimborazograceful spiderta_505ta505 spandex tempest

Notable Campaigns

10
2024-2025US State Department Indictments and Sanctions (2024-2025)
2023GoAnywhere MFT Mass Compromise Campaign (January - February 2023)
2023MOVEit Transfer Mass Compromise Campaign (May - July 2023)
2020-2021Accellion FTA Managed-File-Transfer Compromise Campaign (December 2020 - January 2021)
2019-2020Clop Ransomware Emergence and Operational Expansion (2019-2020)
2019SDBbot RAT and Get2 Downloader Campaign (October 2019)
2018Payload Diversification and Necurs Decline (2018)
2018ServHelper + FlawedGrace Backdoor Family Emergence (November 2018)
2017GlobeImposter Ransomware Mass Distribution (Late 2017)
2014-2017Necurs-Botnet-Distributed Dridex Banking Trojan + Locky Ransomware Campaigns (2014-2017)

Attribution & Reporting

Attributed by
ProofpointMandiantMicrosoft Threat Intelligence CenterIBM X-ForceCrowdStrikeGroup-IBRecorded FutureTrend MicroCybereasonSecureWorksTrellixMcAfeeSymantec / BroadcomCisco TalosANSSI (French national cybersecurity agency)Korean Financial Security Institute (FSI)Fox-IT / NCC GroupYoroiAviraCyberIntBlueliv / Outpost24HornetsecuritySophosPositive TechnologiesCERT-FR
Key reporting
reportProofpoint: Threat Actor Profile, TA505, From Dridex to GlobeImposter (September 27, 2017), canonical first cluster profile
reportProofpoint: TA505 Shifts With The Times (June 8, 2018)
reportProofpoint: ServHelper and FlawedGrace, New Malware Introduced by TA505 (January 9, 2019)
reportProofpoint: TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader (October 15, 2019)
reportANSSI CERT-FR: CERTFR-2020-CTI-009, Development of the Activity of the TA505 Cybercriminal Group (August 20, 2020), canonical French-government formal-attribution publication
reportTrend Micro: TA505 At It Again, Variety Is The Spice Of ServHelper and FlawedAmmyy (August 2019)
reportTrend Micro: Shifting Tactics, Breaking Down TA505 Group Use of HTML, RATs, and Other Techniques in Latest Campaigns (June 2019)
reportFox-IT / NCC Group: TA505, A Brief History of Their Time (November 16, 2020)
reportKorean Financial Security Institute: Profiling of TA505 Threat Group That Continues to Attack the Financial Sector (February 28, 2020)
reportIBM X-Force: Hive0065 (TA505 tracking)
reportMicrosoft Threat Intelligence: Spandex Tempest (formerly CHIMBORAZO) Tracking
reportGroup-IB: Graceful Spider / TA505 Operational Analysis
reportMandiant: TA505 / FIN11 Operational Overlap Analysis
reportCybereason: Threat Actor TA505 Targets Financial Enterprises Using LOLBins and a New Backdoor Malware (2019)
reportPositive Technologies Hacker Groups Profile: TA505
reportCISA + FBI AA23-158A: Cl0p Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability (June 7, 2023)
reportUS State Department Rewards for Justice: Clop Ransomware $10M Bounty (July 11, 2024)
reportMalpedia Actor Profile: TA505
reportMITRE ATT&CK Group G0092, TA505

Operational

State sponsor

Russia-speaking organized cyber-criminal cluster financially- motivated, active publicly since at least 2014. No state-actor attribution has been formally asserted by any government cybersecurity authority.

the cluster is consistently tracked across industry reporting as an organized-cybercrime actor operating from Russia-speaking jurisdictions, almost certainly Russia or adjacent CIS countries. The cluster's malware families (Dridex, FlawedAmmyy, FlawedGrace, ServHelper, SDBbot, Clop ransomware) contain configuration artifacts and operational patterns consistent with Russia-speaking-operator development (CIS-language-exclusion checks on subsequent Clop ransomware payloads, Russian-language cybercrime forum participation, victimology that consistently avoids CIS targets). TA505 has been variously assessed as either (a) a spin-off from or successor to the broader "Business Club" or "Dridex Group" cluster that historically operated Dridex and earlier banking trojans, or (b) the same broader operator membership operating under multiple vendor-tracking labels. Significant operational- tradecraft overlap with FIN11 (Mandiant tracking) has been observed in 2020-2023, particularly in Clop ransomware operations against managed-file-transfer software (Accellion FTA, GoAnywhere MFT, MOVEit Transfer), though Mandiant analytically tracks FIN11 as distinct from TA505 with partially-overlapping operational membership rather than as identical. The cluster's Clop ransomware operations are curated separately in this corpus as cl0p.yaml.

TA505 is curated as the broader umbrella cluster of which Clop is one operation among many in approximately a decade of tracked campaigns.

The TA505
  • Clop relationship is one of the most operationally significant umbrella-to-operation relationships in the modern Russia-speaking-organized-cybercrime ransomware ecosystem.
Motivations
financial_fraud, banking_credential_theft, massive_scale_malspam_distribution, ransomware_extortion, data_theft_and_extortion, access_resale_to_other_groups
Sectors
Regions

Detection Blind Spots

60 techniques
Across this actor’s 60 mapped techniques, the share covered by each detection layer. Low bars are where you’d be blind if this actor targeted you.
Behavioral / log (Sigma)55/60 · 91%
Analytics (MITRE CAR)30/60 · 50%
Runtime / container (Falco)5/60 · 8%
File / malware (YARA)0/60 · 0%
Network (Suricata/Snort)10/60 · 16%
Vuln scan (Nuclei)0/60 · 0%

Atomic Test Plan

30 techniques
Runnable Atomic Red Team tests covering this actor’s mapped techniques - validate your detections against this specific adversary. Cross-reference the blind spots above. For authorized lab / purple-team use. Open the full builder

Tools Used

2 mapped
Other tooling / TTPs (curation, not ATT&CK-mapped):
MARAPMETASPLOITMINERBRIDEMIRRORBLASTSHIFUSILENCE EMAIL STEALERSNATCH
Intelligence Graph · click any node to traverse
CVETechnique ActorTool Family
drag to reposition · click any node to traverse · button top-right enlarges
External lookups - second-class, for what we don’t hold ourselves
Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities
Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs
Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures
Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1
About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service
threatengine.sh  ·  Open-source threat intelligence platform  ·  100+ authoritative sources  ·  Every fact traces to its origin