TA505

Techniques (MITRE ATT&CK)34

SourceMITRE ATT&CK

Target categories: Education, Finance, Health, Retail, Hospitality

Targeted regions: Australia · Canada · Czech Republic · Germany · Hungary · India · Japan · Romania · Serbia · Singapore +6

Also known as:ATK103CHIMBORAZODudearG0092GOLD TAHOEGRACEFUL SPIDERHive0065SectorJ04SectorJ04 GroupSpandex Tempest

Vexday analysis

TA505 é um grupo cibercriminoso ativo desde pelo menos 2014, também rastreado como Hive0065, Spandex Tempest e CHIMBORAZO (identificador MITRE ATT&CK: G0092). O grupo é reconhecido pela frequente troca de malware, por influenciar tendências globais na distribuição de malware criminoso e por campanhas de ransomware associadas ao Clop. Ao todo, 34 técnicas MITRE ATT&CK estão documentadas em seu perfil operacional.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity40

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 34

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Resource development

Domains Malware Tool Upload Malware

Initial access

Spearphishing Attachment Spearphishing Link

Execution

PowerShell Windows Command Shell Visual Basic JavaScript Native API Malicious Link Malicious File Dynamic Data Exchange

Credential access

Credentials In Files Credentials from Web Browsers

Discovery

Permission Groups Discovery Email Account

Command and control

Web Protocols Ingress Tool Transfer Fast Flux DNS

Impact

Data Encrypted for Impact

defense-impairment

Modify Registry Code Signing Mark-of-the-Web Bypass Disable or Modify Tools

stealth

Software Packing Command Obfuscation Encrypted/Encoded File Dynamic-link Library Injection Domain Accounts Deobfuscate/Decode Files or Information Msiexec Rundll32

Exploited vulnerabilities

No CVEs attributed to this group in public sources (MITRE ATT&CK). Absence of attribution does not mean absence of activity.

Known infrastructure 3

Real indicators (C2, domains, URLs and hashes) associated with the malware this group uses. Source: abuse.ch (ThreatFox, URLhaus, MalwareBazaar).

sha1_hashc5ec7e2ad924e832e49fbac9d0c82719b570e080MimiKatzthreatfox

md5_hash77c96f339974b65ae435313a8fcc3b35MimiKatzthreatfox

sha256_hash889cc3e793cb39889c7acc8e73a84973e9a08fcd69451f7b546509c74ffdda90MimiKatzthreatfox

References

TA505 uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →