← Back to Actors
TA505
TA505Hive0065Spandex TempestCHIMBORAZO
[TA505](https://attack.mitre.org/groups/G0092) is a cyber criminal group that has been active since at least 2014. [TA505](https://attack.mitre.org/groups/G0092) is known for frequently changing malware, driving global trends in criminal malware distribution, and ransomware campaigns involving [Clop](https://attack.mitre.org/software/S0611).(Citation: Proofpoint TA505 Sep 2017)(Citation: Proofpoint TA505 June 2018)(Citation: Proofpoint TA505 Jan 2019)(Citation: NCC Group TA505)(Citation: Korean FSI TA505 2020)
35
Techniques
33
Covered
2
Gaps
94%
Coverage
Coverage33/35
COVERED (33)
T1027.002Software Packing2 det.T1027.010Command Obfuscation42 det.T1027.013Encrypted/Encoded File8 det.T1055.001Dynamic-link Library Injection13 det.T1059.001PowerShell384 det.T1059.003Windows Command Shell89 det.T1059.005Visual Basic71 det.T1059.007JavaScript64 det.T1069Permission Groups Discovery40 det.T1071.001Web Protocols83 det.T1078.002Domain Accounts28 det.T1105Ingress Tool Transfer199 det.T1106Native API30 det.T1112Modify Registry208 det.T1140Deobfuscate/Decode Files or Information59 det.T1204.001Malicious Link11 det.T1204.002Malicious File468 det.T1218.007Msiexec37 det.T1218.011Rundll3278 det.T1486Data Encrypted for Impact400 det.T1552.001Credentials In Files62 det.T1553.002Code Signing4 det.T1553.005Mark-of-the-Web Bypass12 det.T1555.003Credentials from Web Browsers16 det.T1559.002Dynamic Data Exchange1 det.T1562.001Disable or Modify Tools332 det.T1566.001Spearphishing Attachment1144 det.T1566.002Spearphishing Link1194 det.T1583.001Domains69 det.T1588.001Malware2 det.T1588.002Tool13 det.T1608.001Upload Malware3 det.T1685Disable or Modify Tools281 det.