TA505 spent a decade turning inbox volume into network access, moving from banking trojans and ransomware spam to remote access trojans, domain takeover and Clop ransomware, and CISA estimates it has compromised more than 8,000 organisations worldwide. This profile covers the financially motivated group that MITRE ATT&CK tracks as G0092, active since at least 2014. It draws on the joint CISA and FBI advisory AA23-158A, MITRE ATT&CK v20, Proofpoint's long-running tracking and Microsoft's naming table. It focuses on the phishing and malware distribution side of the group and how that turned into ransomware; the file transfer zero-day campaigns run under the Clop brand are covered in depth in the Cl0p Threat Actor Profile. It is written for email security, SOC and Active Directory teams and contains no malware internals.
Key takeaways
- It adapts its tooling constantly. MITRE describes TA505 as known for frequently changing malware and driving trends in criminal malware distribution, so detections tied to one family age quickly.
- Volume was the weapon. Proofpoint recorded Dridex campaigns reaching millions of recipients and Locky campaigns of tens of millions of messages each in 2016.
- Attachments changed every few months. Proofpoint lists zipped scripts, .url files, Excel Web Query (.iqy) files, DDE in Word, embedded .lnk files and HTML attachments across 2017 and 2018.
- Ransomware is the end of an identity attack. ATT&CK records AdFind, BloodHound, Mimikatz and domain accounts in TA505 operations before Clop deployment.
- Roles overlap. CISA says TA505 has acted as a ransomware service, an affiliate, an initial access broker, a buyer of access and a botnet operator, so attributing an intrusion by tool alone is unreliable.
Who they are (names and aliases)
MITRE ATT&CK describes TA505 as a cyber criminal group active since at least 2014. AA23-158A names the "CL0P Ransomware Gang, also known as TA505", while vendors keep separate clusters for different parts of the activity. Record which cluster a report means before merging intelligence.
| Name | Source | Notes |
|---|---|---|
| TA505 (G0092) | Proofpoint; MITRE ATT&CK | Proofpoint's tracking name, adopted by MITRE; ATT&CK lists Hive0065, Spandex Tempest and CHIMBORAZO as associated names |
| Spandex Tempest | Microsoft | Microsoft's naming table lists it as financially motivated with other names MONTY SPIDER and TA505 |
| Lace Tempest | Microsoft | A separate Microsoft entry (other name DEV-0950); Microsoft tracks it apart from Spandex Tempest |
| CL0P Ransomware Gang | CISA and FBI, AA23-158A | Treated as the same actor as TA505 in the advisory; Clop ransomware (S0611) appeared in February 2019 as a ransomware service |
No source read for this page names individual members; this page names none. See the Threat Actor Groups Guide for how vendor naming schemes relate.
Targeting and motivation
- Motivation: financial, through banking fraud, ransomware, extortion and selling access.
- Scale: AA23-158A estimates TA505 has compromised more than 3,000 US-based organisations and 8,000 organisations globally, and calls it one of the largest phishing and malspam distributors worldwide.
- Geography: broad. Proofpoint documented Dridex botnets aimed at the UK, US, Canada, Australia and Germany, Shifu campaigns against Japan and the UK, and geo-targeted 2017 waves in the UK, Australia, Luxembourg, Ireland and Belgium.
- Sectors: mostly opportunistic mass spam; the later ransomware and file transfer campaigns hit whichever organisations ran the exposed product.
- Infrastructure dependency: Proofpoint noted that disruptions of the Necurs spam botnet were followed by quiet periods for TA505, then a return at scale when the botnet recovered.
Tactics and techniques (MITRE ATT&CK)
All IDs below are ATT&CK v20 techniques recorded against G0092. Defence impairment now sits under tactic TA0112 Defense Impairment.
| Tactic | Technique | What sources describe | Primary defence |
|---|---|---|---|
| Initial access | T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link | High-volume malspam with rotating attachment types and links | Attachment type blocking and sandboxing; URL rewriting |
| Execution | T1204.002 Malicious File; T1204.001 Malicious Link | Users opening documents, scripts and shortcut files | Block scripts and shortcuts from mail; Mark-of-the-Web |
| Execution | T1059.005 Visual Basic; T1059.007 JavaScript; T1059.001 PowerShell; T1559.002 Dynamic Data Exchange | Script-based first stages and DDE in Office documents | Default script files to open in Notepad; Office DDE disabled; PowerShell logging |
| Stealth | T1218.007 Msiexec; T1218.011 Rundll32; T1553.002 Code Signing | Signed payloads and proxy execution through Windows binaries | Application control; certificate reputation checks |
| Defence impairment | T1553.005 Mark-of-the-Web Bypass; T1685 Disable or Modify Tools | Containers that strip download markings; tool tampering | Block disk images from mail; tamper protection |
| Command and control | T1071.001 Web Protocols; T1568.001 Fast Flux DNS | RATs such as FlawedAmmyy, FlawedGrace and SDBbot | Proxy with category and newly registered domain blocking |
| Discovery | T1069 Permission Groups Discovery; T1087.003 Email Account | AdFind and BloodHound against Active Directory | Alert on bulk LDAP queries from workstations |
| Credential access | T1555.003 Credentials from Web Browsers; T1552.001 Credentials In Files | Stealers such as Azorult; Mimikatz | No browser-saved passwords; Credential Guard |
| Privilege and movement | T1078.002 Domain Accounts | Use of harvested domain accounts | Tiered admin model; privileged account monitoring |
| Impact | T1486 Data Encrypted for Impact | Clop ransomware deployment | Offline backups; rapid isolation |
Malware history
| Period | Main payloads | Source |
|---|---|---|
| 2014 to 2016 | Dridex banking trojan (first TA505 campaign 28 July 2014), Shifu, then Locky ransomware from February 2016 | Proofpoint |
| 2017 | Jaff, Philadelphia and GlobeImposter ransomware; Trickbot; Kegotip stealer | Proofpoint |
| 2018 | Shift to RATs and loaders: FlawedAmmyy via Quant Loader, smaller Dridex and GandCrab runs | Proofpoint |
| 2019 onward | ServHelper, FlawedGrace, Get2 and SDBbot; Clop ransomware from February 2019 | MITRE ATT&CK; AA23-158A |
| 2020 to 2023 | Accellion FTA zero-days with DEWMODE web shell; GoAnywhere MFT (CVE-2023-0669); MOVEit Transfer (CVE-2023-34362) with LEMURLOOT | AA23-158A |
How they abuse identities and credentials
- One workstation, then the directory: a RAT on a single user's machine is used to query Active Directory with AdFind and BloodHound and find a path to domain admin. See the BloodHound and Active Directory Attack Path Guide.
- Harvested domain accounts: ATT&CK records T1078.002. Admins logging on to ordinary workstations leave reusable credentials that Mimikatz collects.
- Browser and file credentials: stealer payloads take saved browser passwords and credentials in files, including service and application credentials nobody rotates.
- Rogue admin accounts on servers: AA23-158A says the LEMURLOOT web shell could create and delete administrator accounts named "Health Check Service". New local or application admin accounts should alert immediately.
- Compromised mailboxes for extortion: in the 2025 Oracle E-Business Suite campaign run under the Cl0p brand, extortion mail came from hundreds or more compromised third-party accounts, which Google believes were bought from infostealer logs.
Notable incidents
| Date | Event | Source |
|---|---|---|
| July 2014 | First observed TA505 Dridex campaign | Proofpoint |
| July to December 2016 | Near-exclusive Locky distribution, tens of millions of messages per campaign | Proofpoint |
| March to June 2018 | FlawedAmmyy RAT campaigns using .url and .iqy attachments | Proofpoint |
| February 2019 | Clop appears as a ransomware service | AA23-158A |
| 2020 to 2021 | Accellion FTA zero-days and DEWMODE web shell | AA23-158A |
| Early 2023 | GoAnywhere MFT exploitation, about 130 claimed victims in ten days | AA23-158A |
| From 27 May 2023 | MOVEit Transfer exploitation; CISA adds CVE-2023-34362 to KEV on 2 June | AA23-158A |
For the 2023 to 2025 file transfer campaigns, victim counts and the Oracle zero-day, see the Cl0p Threat Actor Profile and the MOVEit Transfer Hardening Guide.
Detection and defence
What to monitor
| Signal | Data source | Why it matters |
|---|---|---|
| wscript.exe, mshta.exe or Excel spawning network connections or child processes | EDR; Sysmon Event IDs 1 and 3 | Script and .iqy first stages |
| msiexec.exe or rundll32.exe loading payloads from user-writable paths | EDR; Security Event ID 4688 | ATT&CK records both proxy executions |
| Bulk LDAP queries or BloodHound collection from a workstation | Domain controller LDAP logging; EDR; Event ID 1644 where enabled | Directory reconnaissance before escalation |
| Privileged group changes and new admin accounts | Security Event IDs 4728, 4732, 4756 and 4720 | Escalation and persistence |
| New or modified .aspx files on file transfer servers | File integrity monitoring | DEWMODE and LEMURLOOT were web shells |
| Unknown remote admin tools or RATs beaconing | Proxy and DNS logs; EDR | FlawedAmmyy and similar tools gave hands-on access |
Phased response plan
- Close the attachment routes: block scripts, shortcut files, .url, .iqy, HTML and disk images from external mail, and disable DDE in Office. Test against a week of legitimate inbound mail first. See the Email Security Guide and the Malicious LNK Files Guide.
- Change default handlers: map .js, .vbs, .wsf and .hta to Notepad by Group Policy, so a double-click opens text instead of running code. Pilot with IT first and keep the GPO unlinked for rollback.
- Restrict proxy execution: use WDAC or AppLocker to stop msiexec and rundll32 running content from user profiles, starting in audit mode.
- Harden the directory: tiered administration so domain admins never log on to workstations, Credential Guard, LAPS, and alerting on privileged group changes. See the Active Directory and Entra ID Hardening Guide.
- Patch exposed transfer and edge products first: CISA's mitigations put known exploited vulnerabilities on internet-facing systems at the top of the list.
- Keep recovery independent: encrypted, immutable and offline backups with tested restores, as AA23-158A recommends.
Decision guidance
- Small organisations: strict attachment filtering, Notepad as the default script handler, MFA and offline backups cover most of the TA505 chain. Managed detection is better value than an in-house SOC.
- Large organisations: invest in directory monitoring and tiering, because the mass phishing stage will eventually succeed somewhere in a large estate.
- Attribution in triage: do not wait to confirm TA505. CISA's description of overlapping roles means the same response applies to any RAT-to-domain chain.
Metrics
- Percentage of inbound mail with risky attachment types blocked or sandboxed.
- Percentage of endpoints where script files open in Notepad by default.
- Number of privileged account logons to workstations per week (target zero).
- Mean time to detect simulated BloodHound collection in purple team exercises.
- Days to patch KEV-listed flaws on internet-facing systems.
Framework mapping
| Control area | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|
| Mail filtering and malicious code protection | SI-3, SI-8 | DE.CM-09 |
| Application control | CM-7(5) | PR.PS-01 |
| Least privilege and admin tiering | AC-6, AC-2 | PR.AA-05 |
| MFA | IA-2(1) | PR.AA-03 |
| Vulnerability remediation | SI-2, RA-5 | ID.RA-01 |
| Backups | CP-9 | PR.DS-11 |
Common failure patterns
- Blocking last quarter's attachment type: TA505 rotated formats every few months; block by risk class, not by the latest family.
- Treating a RAT alert as a desktop issue: a FlawedAmmyy or SDBbot infection is the start of a domain compromise and needs a hunt for directory reconnaissance.
- Domain admins on workstations: one harvested logon gives the domain away.
- Unwatched file transfer servers: internet-facing transfer products went unpatched and unmonitored until data had already left.
- Trusting signed binaries: ATT&CK records code signing; signature alone is not a safety verdict.
Practitioner checklist
- Block scripts, shortcuts, .url, .iqy, HTML and disk image attachments from external mail.
- Set Notepad as the default handler for Windows script file types.
- Disable DDE and block macros from the internet in Office.
- Run WDAC or AppLocker rules against msiexec and rundll32 from user paths.
- Enforce tiered administration and alert on privileged group changes.
- Monitor for AdFind and BloodHound style LDAP collection.
- Patch KEV-listed flaws on internet-facing file transfer and edge products first.
- Monitor web roots on transfer servers for new .aspx files and new admin accounts.
- Keep encrypted, immutable, offline backups and test restores.
Standards and references
- CISA and FBI: #StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability (AA23-158A)
- MITRE ATT&CK: TA505 (G0092)
- MITRE ATT&CK: Clop (S0611)
- CISA: Known Exploited Vulnerabilities Catalog
- Microsoft: How Microsoft names threat actors
- Proofpoint: Threat Actor Profile: TA505, From Dridex to GlobeImposter
- Proofpoint: TA505 Shifts With the Times
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: Cl0p Threat Actor Profile · Malware Loaders and Droppers Guide · Botnets Guide · Active Directory Domain Compromise Response Playbook · Raspberry Robin Malware Guide