G0092
G0092TA505
Description
[TA505](https://attack.mitre.org/groups/G0092) is a cyber criminal group that has been active since at least 2014. [TA505](https://attack.mitre.org/groups/G0092) is known for frequently changing malware, driving global trends in criminal malware distribution, and ransomware campaigns involving [Clop](https://attack.mitre.org/software/S0611).(Citation: Proofpoint TA505 Sep 2017)(Citation: Proofpoint TA505 June 2018)(Citation: Proofpoint TA505 Jan 2019)(Citation: NCC Group TA505)(Citation: Korean FSI TA505 2020)
References
- https://attack.mitre.org/groups/G0092
- https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory=
- https://securityintelligence.com/posts/ta505-continues-to-infect-networks-with-sdbbot-rat/
- https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta505-dridex-globeimposter
- https://www.proofpoint.com/us/threat-insight/post/ta505-shifts-times
- https://www.proofpoint.com/us/threat-insight/post/servhelper-and-flawedgrace-new-malware-introduced-ta505
- https://research.nccgroup.com/2020/11/18/ta505-a-brief-history-of-their-time/
Software attributed to this2
| Type | Target | Confidence | Tier |
|---|---|---|---|
| Software | SDBbots0461 | 100% | live |
| Software | Get2s0460 | 95% | live |
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.