Opening Forensia workspaceacquiring
Loading the current evidence view. Navigation and account controls remain available.
Loading recent evidenceacquiring
Threat actors
Loading the current evidence view. Navigation and account controls remain available.
Also known as: Hive0065, Spandex Tempest, CHIMBORAZO
34
techniques
16
software
11,640
corpus matches
profile
TA505 is a cyber criminal group that has been active since at least 2014. TA505 is known for frequently changing malware, driving global trends in criminal malware distribution, and ransomware campaigns involving Clop.
techniques
34 attributed · most-instrumented first
software
16 malware & tools attributed
Mimikatz
S0002
Net
S0039
Cobalt Strike
S0154
PowerSploit
S0194
TrickBot
S0266
Azorult
S0344
FlawedAmmyy
S0381
ServHelper
S0382
FlawedGrace
S0383
Dridex
S0384
read this carefully
11,640 corpus matches is not attribution
That count is indicators which exhibit techniques TA505 is known to use. Many unrelated operators use the same techniques. Treat it as a shared-technique signal for hunting, never as first-party attribution to this group.
indicators exhibiting these techniques
Top by severity: each resolves to its own verdict.
+22 more techniques
Get2
S0460
SDBbot
S0461
BloodHound
S0521
AdFind
S0552
Clop
S0611
Amadey
S1025
showing 30 of 11,640
known aliases
Vendors name the same group differently. Searching any alias reaches this profile.