TA505
IntrusionSet · ATTACK:enterprise:G0092
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G0092",
"title": "TA505",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G0092",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--7eda3dd8-b09b-4705-8090-c2ad9fb8c14d",
"external_id": "G0092",
"domain": "enterprise",
"created": "2019-05-28T15:54:17.213Z",
"modified": "2026-07-31T18:48:04.495Z",
"version": "3.0",
"aliases": [
"TA505",
"Hive0065",
"Spandex Tempest",
"CHIMBORAZO"
],
"tactics": [
],
"source_references": [
{
"source_name": "Hive0065"
},
{
"source_name": "Spandex Tempest"
},
{
"source_name": "CHIMBORAZO"
},
{
"source_name": "Korean FSI TA505 2020",
"url": "https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory="
},
{
"source_name": "IBM TA505 April 2020",
"url": "https://web.archive.org/web/20200420201624/https://securityintelligence.com/posts/ta505-continues-to-infect-networks-with-sdbbot-rat/"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Proofpoint TA505 Sep 2017",
"url": "https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta505-dridex-globeimposter"
},
{
"source_name": "Proofpoint TA505 June 2018",
"url": "https://www.proofpoint.com/us/threat-insight/post/ta505-shifts-times"
},
{
"source_name": "Proofpoint TA505 Jan 2019",
"url": "https://www.proofpoint.com/us/threat-insight/post/servhelper-and-flawedgrace-new-malware-introduced-ta505"
},
{
"source_name": "NCC Group TA505",
"url": "https://research.nccgroup.com/2020/11/18/ta505-a-brief-history-of-their-time/"
}
]
}Explicit source assertions (50)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:S0552
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--01253fc1-ee00-438a-ba98-fc8db655b7d3
NCC Group TA505ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1087.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--02c88228-8275-42a7-9c3a-d5393556bceb
Trend Micro TA505 June 2019ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:S0611
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0d6df769-7a34-4642-85f5-bf577973456e
Unit42 Clop April 2021 · Cybereason Clop Dec 2020ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1583.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0dcab59a-f989-4109-a667-d6b98898274b
Korean FSI TA505 2020ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:S0344
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--15d668bc-9f10-49eb-8ed1-dfc82b8b8a62
NCC Group TA505ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:S0381
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1b215137-e9e7-4022-af63-8d932c384eb2
Proofpoint TA505 Mar 2018 · Trend Micro TA505 June 2019 · Proofpoint TA505 October 2019ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:S0002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1d0d0fe6-f16d-4c69-bbaf-1d5423b852fb
NCC Group TA505ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:S0384
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e7f0283-1aeb-4b9e-81e0-4aec48e30228
IBM TA505 April 2020 · Proofpoint TA505 Sep 2017 · Proofpoint TA505 June 2018ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:S0266
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--239a4ed5-afe6-4d1d-8dfe-ee4df7bc01ba
IBM TA505 April 2020 · Proofpoint TA505 Sep 2017ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1553.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--246e66e1-ddd2-4e51-b54c-1579f6ea1626
TrendMicro TA505 Aug 2019ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1218.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2f350d97-8492-4eb4-8640-2c3ae2bc8df1
Trend Micro TA505 June 2019 · Cybereason TA505 April 2019 · Deep Instinct TA505 Apr 2019ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:S0460
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--351bb2c4-db16-4c82-9539-3851dd61c608
Proofpoint TA505 October 2019ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3debe0d7-63bb-4e21-bf9b-ed5e23140e57
Korean FSI TA505 2020ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3e6b6ed9-4c28-4dd0-903a-360f57864de4
NCC Group TA505ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--49d6508c-f350-4376-ba32-f64693d7fd10
IBM TA505 April 2020 · Trend Micro TA505 June 2019 · Proofpoint TA505 Sep 2017 · ProofPoint SettingContent-ms July 2018 · Proofpoint TA505 June 2018 · Proofpoint TA505 Mar 2018 · Cybereason TA505 April 2019 · Proofpoint TA505 Jan 2019 · Proofpoint TA505 October 2019ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1568.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--53356453-2cf1-46d9-ac8f-77fc3a2274d9
Trend Micro TA505 June 2019ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--53e89989-29a6-461f-854c-42eb96b221b3
Proofpoint TA505 Sep 2017ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--573f3932-8435-4b4a-b138-d9c955495197
IBM TA505 April 2020ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1552.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--580103be-ffce-4677-b24a-7092c1221ed0
Proofpoint TA505 Sep 2017ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5aaee352-e4b5-4d4c-b021-9f38adb346da
IBM TA505 April 2020 · Trend Micro TA505 June 2019 · Proofpoint TA505 Sep 2017 · Proofpoint TA505 June 2018ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:S0383
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--60026624-0ae9-439a-8ee8-faee7ce6ddf0
Proofpoint TA505 Jan 2019 · Trend Micro TA505 June 2019 · Proofpoint TA505 October 2019ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6f57b4eb-ba87-4755-9b96-3715e1da1de1
Proofpoint TA505 Sep 2017 · Proofpoint TA505 June 2018ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1204.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--71ee0311-3fdc-4baf-8c3e-2143416b742c
Proofpoint TA505 Sep 2017 · Proofpoint TA505 June 2018 · Proofpoint TA505 Jan 2019 · Cybereason TA505 April 2019 · ProofPoint SettingContent-ms July 2018 · Proofpoint TA505 Mar 2018 · Trend Micro TA505 June 2019 · Proofpoint TA505 October 2019ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:S0154
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--74dcdf15-ebdf-4faa-8316-cbf1429a8cea
NCC Group TA505ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:S0382
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7575fb4d-0fa3-4a16-acb6-734841da41bc
Trend Micro TA505 June 2019 · Cybereason TA505 April 2019 · Proofpoint TA505 Jan 2019 · Deep Instinct TA505 Apr 2019ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1608.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--75a91f69-93bc-40fd-a17c-ae675637c296
Korean FSI TA505 2020ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:S0521
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--77d30a4e-d267-4416-85f2-edebc0a6af29
NCC Group TA505ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--841acdc1-42c3-4f7d-9840-c9e4057bc2ab
Cybereason TA505 April 2019 · Deep Instinct TA505 Apr 2019ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8bba06f3-fac2-4484-a177-53d5716f80a6
NCC Group TA505ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:S1025
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8f533903-39c5-4463-a0f6-8017fc6b10ab
Korean FSI TA505 2020 · BlackBerry Amadey 2020ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1555.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9e27c930-eba5-467f-90e5-4ec5b4219735
Proofpoint TA505 Sep 2017ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1027.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a8b86839-9c18-465d-aa02-0f0b0132421b
Cybereason TA505 April 2019 · Deep Instinct TA505 Apr 2019ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1069
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a9a39a39-b339-41d9-9790-198ac9352bfd
IBM TA505 April 2020 · Trend Micro TA505 June 2019ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b3436a7d-81cf-4f79-9c74-e3b2370288d2
ProofPoint SettingContent-ms July 2018 · Cybereason TA505 April 2019 · Deep Instinct TA505 Apr 2019ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1588.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b359d367-d52c-4835-b242-1073d8a55bc3
NCC Group TA505ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b7a9afc1-3bbf-4eda-9709-5392156c1e41
IBM TA505 April 2020ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1553.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--badc4d79-2f59-4b9b-9044-9c53dcd386c0
Trend Micro TA505 June 2019 · Cybereason TA505 April 2019 · Deep Instinct TA505 Apr 2019ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:S0461
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c07d6bad-8249-46c2-971f-66e779229be0
IBM TA505 April 2020 · Proofpoint TA505 October 2019ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c5be8127-669e-49b9-b603-581e3498d203
Trend Micro TA505 June 2019ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1486
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c99ee3c6-7d62-4514-bdac-4bf899ea0c16
Proofpoint TA505 Sep 2017ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ca484dbf-aa28-4d7e-90bb-b60723ff70b1
Proofpoint TA505 Sep 2017 · ProofPoint SettingContent-ms July 2018 · Cybereason TA505 April 2019 · Deep Instinct TA505 Apr 2019ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ce962c48-3390-4286-91bb-b38d7fb4f07a
IBM TA505 April 2020 · Trend Micro TA505 June 2019 · Proofpoint TA505 Sep 2017 · ProofPoint SettingContent-ms July 2018 · Proofpoint TA505 June 2018 · Proofpoint TA505 Mar 2018 · Cybereason TA505 April 2019 · Proofpoint TA505 Jan 2019 · Proofpoint TA505 October 2019ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d7cfd2b5-c297-4000-b179-aca649a05f65
Korean FSI TA505 2020ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:S0194
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e3c860e4-c981-4a9a-8a8e-8ba0207f834b
NCC Group TA505ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e3f7935d-0f3a-440a-be19-ef9383914441
Proofpoint TA505 Sep 2017 · Proofpoint TA505 Jan 2019 · Trend Micro TA505 June 2019 · Proofpoint TA505 October 2019ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eac7af33-0dd4-48aa-a78b-8c422ea3e482
Korean FSI TA505 2020ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1559.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f0e944fa-6dba-47c3-920a-cf7bad2d3bc5
Proofpoint TA505 June 2018ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1055.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f1459bdf-06ae-435a-8506-1e8e444a410b
IBM TA505 April 2020ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f8e25c1f-84bd-4ddd-bf18-51543d5cff94
IBM TA505 April 2020ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fee6aca0-dcb7-43b4-a253-66913620631a
Trend Micro TA505 June 2019