G009210 cited sources

TA505

Also tracked as Hive0065, Spandex Tempest, CHIMBORAZO

Techniques Mapped34

Tools & Malware16

Campaigns TrackedNone published

Last Updated (MITRE)Jul 31, 2026

Description (MITRE ATT&CK)

TA505 is a cyber criminal group that has been active since at least 2014. TA505 is known for frequently changing malware, driving global trends in criminal malware distribution, and ransomware campaigns involving Clop.

Known Techniques by Tactic

Stealth (8)

Execution (8)

Associated Tools & Malware

AdFind (tool)Clop (malware)Azorult (malware)FlawedAmmyy (malware)Mimikatz (tool)Dridex (malware)TrickBot (malware)Get2 (malware)FlawedGrace (malware)Cobalt Strike

Seraph Context

Organisational Relevance

Shown when this actor's known techniques match your monitored environment.

Exploited CVE Correlation

Surfaced when a technique used by this actor maps to a tracked CISA KEV entry.

Sector & Regional Signal

Derived from MITRE's own published description text, never asserted beyond it.

Watchlist

Signed-in customers can track this actor and be notified of profile updates.

Is this actor relevant to your environment?

Match this actor's known techniques against the technologies you run inside Seraph CTI, and get notified if their profile changes.

Explore Seraph CTI Back to Threat Actors

TA505

Description (MITRE ATT&CK)

Known Techniques by Tactic

Stealth (8)

Execution (8)

Associated Tools & Malware

Seraph Context

Organisational Relevance

Exploited CVE Correlation

Sector & Regional Signal

Watchlist

Other extensively documented threat actors.

Is this actor relevant to your environment?

Resource Development (4)

Defense Impairment (4)

Command And Control (3)

Initial Access (3)

Persistence (2)

Credential Access (2)

Discovery (2)

Privilege Escalation (2)

Impact (1)