{
  "id": "ta505",
  "name": "TA505",
  "aliases": [
    "Hive0065",
    "Spandex Tempest",
    "CHIMBORAZO"
  ],
  "domain": "cyber",
  "country": "UNK",
  "category": "Cybercriminal group",
  "status": "tracked",
  "fielded": null,
  "operators": [],
  "summary": "TA505 is a cyber criminal group that has been active since at least 2014. TA505 is known for frequently changing malware, driving global trends in criminal malware distribution, and ransomware campaigns involving Clop.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Cybercriminal group",
      "src": [
        "mitre-g0092"
      ],
      "conf": "medium"
    },
    {
      "k": "active_since",
      "v": 2014,
      "src": [
        "mitre-g0092"
      ],
      "conf": "medium",
      "note": "At least 2014"
    },
    {
      "k": "attack_id",
      "v": "G0092",
      "src": [
        "mitre-g0092"
      ],
      "conf": "high"
    },
    {
      "k": "techniques_count",
      "v": 34,
      "src": [
        "mitre-g0092"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "AdFind, Amadey, Azorult, BloodHound, Clop, Cobalt Strike, Dridex, FlawedAmmyy, FlawedGrace, Get2, Mimikatz, Net, PowerSploit, SDBbot, ServHelper, TrickBot",
      "src": [
        "mitre-g0092"
      ],
      "conf": "high",
      "note": "16 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "TA505 is a cyber criminal group that has been active since at least 2014. TA505 is known for frequently changing malware, driving global trends in criminal malware distribution, and ransomware campaigns involving Clop. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G0092)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/ta505.html",
  "sources": {
    "mitre-g0092": {
      "title": "TA505, Group G0092",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G0092/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}