Threat Actor 🇷🇺 Russia

TA505

Also known as: SectorJ04 · SectorJ04 Group · GRACEFUL SPIDER · GOLD TAHOE · Dudear · G0092 · ATK103 · Hive0065 · CHIMBORAZO · Spandex Tempest

TA505, the name given by Proofpoint, has been in the cybercrime business for at least four years. This is the group behind the infamous Dridex banking trojan and Locky ransomware, delivered through malicious email campaigns via Necurs botnet. Other malware associated with TA505 include Philadelphia and GlobeImposter ransomware families.

Indicators of Compromise 4

IP 104[.]243[.]35[.]63 IP 216[.]152[.]148[.]54 IP 216[.]152[.]151[.]204 IP 5[.]180[.]41[.]35

MITRE ATT&CK TTPs 3

T1059.007
JavaScript
Execution
 T1105
Ingress Tool Transfer
Command And Control
 T1210
Exploitation of Remote Services
Lateral Movement

Source Articles

Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE
Cl0p-affiliated threat actors are exploiting critical vulnerabilities in internet-exposed PTC Windchill and FlexPLM systems to achieve unauthenticated remote code execution. The attackers deploy hex-named JSP web shells to gain persistent access, conduct data exfiltration, and carry out double extortion. This campaign targets high-value sectors such as manufacturing, automotive, aerospace, and retail, leveraging known vulnerabilities to compromise enterprise applications.
hacker-news ·3d ago