TA505

TA505 is a cyber criminal group that has been active since at least 2014. TA505 is known for frequently changing malware, driving global trends in criminal malware distribution, and ransomware campaigns involving Clop.

View MITRE record ↗

• Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2
• Frydrych, M. (2020, April 14). TA505 Continues to Infect Networks With SDBbot RAT. Retrieved May 29, 2020.
• Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.
• Proofpoint Staff. (2017, September 27). Threat Actor Profile: TA505, From Dridex to GlobeImposter. Retrieved May 28, 2019.
• Proofpoint Staff. (2018, June 8). TA505 shifts with the times. Retrieved May 28, 2019.
• Schwarz, D. and Proofpoint Staff. (2019, January 9). ServHelper and FlawedGrace - New malware introduced by TA505. Retrieved May 28, 2019.
• Terefos, A. (2020, November 18). TA505: A Brief History of Their Time. Retrieved July 14, 2022.