[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fo1be_W3zDkOLelB3ulwRrWPnQsXKfHLdxGmJXgH7_Ds":3},{"success":4,"data":5},true,{"name":6,"slug":7,"aliases":8,"description":19,"country":20,"suspected_sponsor":21,"target_industries":22,"target_countries":28,"incident_types":45,"references":46,"techniques":66,"technique_count":118,"created_at":119,"seoMetadata":120,"schemaOrg":124},"TA505","ta505",[9,10,11,12,13,14,15,16,17,18],"SectorJ04","SectorJ04 Group","GRACEFUL SPIDER","GOLD TAHOE","Dudear","G0092","ATK103","Hive0065","CHIMBORAZO","Spandex Tempest","TA505, the name given by Proofpoint, has been in the cybercrime business for at least four years. This is the group behind the infamous Dridex banking trojan and Locky ransomware, delivered through malicious email campaigns via Necurs botnet. Other malware associated with TA505 include Philadelphia and GlobeImposter ransomware families.","RU",null,[23,24,25,26,27],"Education","Finance","Health","Retail","Hospitality",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44],"Australia","Canada","Czech Republic","Germany","Hungary","India","Japan","Romania","Serbia","Singapore","South Korea","Spain","Thailand","Turkey","United Kingdom","United States",[],[47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65],"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fta505-group-adopts-new-servhelper-backdoor-and-flawedgrace-rat\u002F","https:\u002F\u002Fwww.proofpoint.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fta505_timeline_final4_0.png","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fthreat-insight\u002Fpost\u002Fthreat-actor-profile-ta505-dridex-globeimposter","https:\u002F\u002Fwww.cybereason.com\u002Fblog\u002Fthreat-actor-ta505-targets-financial-enterprises-using-lolbins-and-a-new-backdoor-malware","https:\u002F\u002Fe.cyberint.com\u002Fhubfs\u002FReport%20Legit%20Remote%20Access%20Tools%20Turn%20Into%20Threat%20Actors%20Tools\u002FCyberInt_Legit%20Remote%20Access%20Tools%20Turn%20Into%20Threat%20Actors'%20Tools_Report.pdf","https:\u002F\u002Fthreatpost.com\u002Fta505-servhelper-malware\u002F140792\u002F","https:\u002F\u002Fblog.yoroi.company\u002Fresearch\u002Fthe-stealthy-email-stealer-in-the-ta505-arsenal\u002F","https:\u002F\u002Fthreatrecon.nshc.net\u002F2019\u002F08\u002F29\u002Fsectorj04-groups-increased-activity-in-2019\u002F","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fthreat-insight\u002Fpost\u002Fta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader","https:\u002F\u002Fwww.blueliv.com\u002Fcyber-security-and-cyber-threat-intelligence-blog-blueliv\u002Fresearch\u002Fservhelper-evolution-and-new-ta505-campaigns\u002F","https:\u002F\u002Fwww.telekom.com\u002Fen\u002Fblog\u002Fgroup\u002Farticle\u002Fcybersecurity-ta505-s-box-of-chocolate-597672","https:\u002F\u002Fwww.telekom.com\u002Fen\u002Fblog\u002Fgroup\u002Farticle\u002Fcybersecurity-ta505-returns-with-a-new-bag-of-tricks-602104","https:\u002F\u002Fwww.secureworks.com\u002Fresearch\u002Fthreat-profiles\u002Fgold-tahoe","https:\u002F\u002Fwww.telekom.com\u002Fen\u002Fblog\u002Fgroup\u002Farticle\u002Feager-beaver-a-short-overview-of-the-restless-threat-actor-ta505-609546","https:\u002F\u002Fblog.fox-it.com\u002F2020\u002F11\u002F16\u002Fta505-a-brief-history-of-their-time\u002F","https:\u002F\u002Fwww.secureworks.com\u002Fblog\u002Fhow-cyber-adversaries-are-adapting-to-exploit-the-global-pandemic","https:\u002F\u002Fcyberthreat.thalesgroup.com\u002Fattackers\u002FATK103","https:\u002F\u002Fsecurityintelligence.com\u002Fposts\u002Fta505-continues-to-infect-networks-with-sdbbot-rat\u002F","https:\u002F\u002Fwww.tenable.com\u002Fblog\u002Fcve-2020-1472-advanced-persistent-threat-actors-use-zerologon-vulnerability-in-exploit-chain",[67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117],"T1027.002","T1027","T1087","T1087.003","T1583","T1583.001","T1071","T1071.001","T1059","T1059.001","T1059.003","T1059.005","T1059.007","T1555","T1555.003","T1486","T1140","T1568","T1568.001","T1105","T1559","T1559.002","T1112","T1106","T1027.010","T1027.013","T1588","T1588.001","T1588.002","T1069","T1566","T1566.001","T1566.002","T1055","T1055.001","T1608","T1608.001","T1553","T1553.002","T1553.005","T1218","T1218.007","T1218.011","T1552","T1552.001","T1204","T1204.001","T1204.002","T1078","T1078.002","T1685",51,"2023-08-09T17:25:09.409843+00:00",{"title":121,"metaDescription":122,"keywords":123},"TA505 Threat Actor Profile | Precursor Intelligence","TA505, the name given by Proofpoint, has been in the cybercrime business for at least four years. This is the group behind the infamous Dridex banking...","TA505, SectorJ04, SectorJ04 Group, GRACEFUL SPIDER, GOLD TAHOE, Dudear, G0092, ATK103, Hive0065, CHIMBORAZO, Spandex Tempest, threat actor, APT, cyber threat, threat intelligence, Education, Finance, Health, RU",{"@context":125,"@type":126,"name":6,"alternateName":127,"description":19,"url":128,"mainEntityOfPage":129,"location":131},"https:\u002F\u002Fschema.org","Organization",[9,10,11,12,13,14,15,16,17,18],"http:\u002F\u002Flocalhost:3000\u002Fthreat-actors\u002Fta505",{"@type":130,"@id":128},"WebPage",{"@type":132,"name":20},"Country"]