Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
Financially Motivated46 malware familiesExploits CVEs in the wild

TA505

Also known asCHIMBORAZOcl0pcl0p_(kta080)cl0p_branded_extortion_operationscl0p_cybercrime_groupcl0p_extortion_gangcl0p_gangcl0p_ransomware_crewcl0p_ransomware_gangcl0p_ransomware_groupcl0p_ransomware_operationcl0p_syndicatecl0p_teamcl0p^_leaksclopclop_crewclop_cybercrime_groupclop_cybercriminal_gangclop_extortion_gangclop_extortion_groupclop_gangclop_ransomwareclop_ransomware_and_data_extortion_groupclop_ransomware_gangclop_ransomware_operationclop_ransomware_teamgold_tahoeGRACEFUL SPIDERHive0065MONTY SPIDERSpandex TempestTA505

TA505 is a financially motivated cybercrime threat actor associated in the provided content with large-scale malware delivery campaigns and with the Cl0p/Clop ransomware and extortion operation. Known aliases in the content include TA505, Cl0p/Clop, Graceful Spider, Gold Tahoe, Hive0065, Monty Spider, Spandex Tempest, and Chimborazo. The content also includes Cl0p-branded variants such as Cl0p ransomware gang, Cl0p extortion gang, Cl0p ransomware operation, and related naming variants. The content links TA505 to phishing and malspam campaigns that used lures to get users to enable content in malicious attachments and execute files from archives. Observed delivery methods include malicious Microsoft Office and Publisher attachments with macros, PDF lures, direct URLs, malicious Excel 4.0 macros, and later Bit.ly-linked landing pages serving malicious Excel files. TA505 is associated in the content with the Get2 downloader, ServHelper backdoor, FlawedGrace RAT, FlawedAmmyy RAT, SDBbot, Snatch, Azorult, and Cobalt Strike. The content states that TA505 staged malware on actor-controlled domains and used HTTP for command-and-control. In one ServHelper campaign, the malware collected host and workgroup or domain information, sent it to C2, executed commands including "net group /domain," used PowerShell for reconnaissance, and established persistence via a Run key. ServHelper variants described in the content supported shell execution, downloading additional malware, self-deletion, reverse SSH tunneling for RDP access, browser-profile hijacking, and additional loader functionality. The content also notes TA505 decrypted packed DLLs with an XOR key. Targeting described in the content includes financial institutions, retail businesses, restaurants, and broader multi-sector campaigns across multiple countries. One analysis assessed the operators as especially interested in domain-joined machines and suggested financial organizations as likely targets. The content also ties TA505 to the Cl0p ransomware/extortion operation, including exploitation of MOVEit software and the Cleo zero-day vulnerability CVE-2024-55956 from late 2024 into H1 2025. The content states TA505 (CL0P) exploited the Cleo vulnerability to target a large number of companies and that Cl0p took credit for widespread exploitation of MOVEit instances. Cl0p activity described in the content includes posting victims on its leak site, setting deadlines for MOVEit victims to contact the group, using apparent "name and shame" pressure tactics, and removing some organizations from the leak site after negotiations or presumed payment. S2W ranked TA505 among the top five highest-risk ransomware groups in H1 2025.

Share:
Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

MITRE ATT&CK

Tradecraft

55 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

15 of 15 tactics73 techniques×N= number of intelligence reports citing this technique
MITRE ATT&CK
TA0043
Reconnaissance
2 techniques
T1592
Gather Victim Host Information
T1595
Active Scanning
TA0042
Resource Development
2 techniques
T1587
Develop Capabilities
T1587.001
Malware
T1588
Obtain Capabilities
T1588.001
Malware
TA0001
Initial Access
3 techniques
T1190×13
Exploit Public-Facing Application
T1195
Supply Chain Compromise
T1566
Phishing
T1566.001×4
Spearphishing Attachment
T1566.002×2
Spearphishing Link
TA0002
Execution
4 techniques
T1053
Scheduled Task/Job
T1053.005
Scheduled Task
T1059×3
Command and Scripting Interpreter
T1059.001×2
PowerShell
T1059.003×3
Windows Command Shell
T1059.005×3
Visual Basic
T1059.007
JavaScript
T1203×2
Exploitation for Client Execution
T1204×2
User Execution
T1204.002×4
Malicious File
TA0003
Persistence
6 techniques
T1053
Scheduled Task/Job
T1053.005
Scheduled Task
T1112
Modify Registry
T1136
Create Account
T1136.001
Local Account
T1505
Server Software Component
T1505.003×2
Web Shell
T1547
Boot or Logon Autostart Execution
T1547.001×2
Registry Run Keys / Startup Folder
T1556
Modify Authentication Process
TA0004
Privilege Escalation
3 techniques
T1053
Scheduled Task/Job
T1053.005
Scheduled Task
T1068
Exploitation for Privilege Escalation
T1547
Boot or Logon Autostart Execution
T1547.001×2
Registry Run Keys / Startup Folder
TA0005
Stealth
5 techniques
T1027
Obfuscated Files or Information
T1027.002
Software Packing
T1027.009
Embedded Payloads
T1070
Indicator Removal
T1070.004×3
File Deletion
T1140×2
Deobfuscate/Decode Files or Information
T1497
Virtualization/Sandbox Evasion
T1620
Reflective Code Loading
TA0112
Defense Impairment
2 techniques
T1112
Modify Registry
T1556
Modify Authentication Process
TA0006
Credential Access
1 technique
T1556
Modify Authentication Process
TA0007
Discovery
6 techniques
T1033
System Owner/User Discovery
T1057×2
Process Discovery
T1082×2
System Information Discovery
T1083×2
File and Directory Discovery
T1482
Domain Trust Discovery
T1497
Virtualization/Sandbox Evasion
TA0008
Lateral Movement
1 technique
T1021
Remote Services
T1021.001×2
Remote Desktop Protocol
T1021.002
SMB/Windows Admin Shares
TA0009
Collection
4 techniques
T1113
Screen Capture
T1185
Browser Session Hijacking
T1213
Data from Information Repositories
T1560
Archive Collected Data
TA0011
Command and Control
5 techniques
T1071
Application Layer Protocol
T1071.001×3
Web Protocols
T1090
Proxy
T1090.002
External Proxy
T1095
Non-Application Layer Protocol
T1105×5
Ingress Tool Transfer
T1219
Remote Access Tools
TA0010
Exfiltration
2 techniques
T1041
Exfiltration Over C2 Channel
T1567
Exfiltration Over Web Service
TA0040
Impact
4 techniques
T1486×3
Data Encrypted for Impact
T1490
Inhibit System Recovery
T1529
System Shutdown/Reboot
T1657
Financial Theft
WEAPONIZED

Associated vulnerabilities

13 CVEs this actor has used in observed campaigns. 13 of them exploited in the wild.

CVE-2025-61882Unauthenticated RCE in Oracle E-Business Suite Concurrent Processing BI Publisher IntegrationIn the wildEvidence29

Attackers can seize control of Oracle E-Business Suite environments without authentication, leveraging a critical flaw in the Concurrent Processing (BI Publisher Integration) component. This vulnerability, tracked as CVE-2025-61882, exposes thousands of enterprises to remote compromise via a single HTTP request.

CVE-2023-34362SQL Injection in Progress MOVEit TransferIn the wildEvidence24

MOVEit customers found themselves the victim of an actively exploited zero-day vulnerability, since tracked as CVE-2023-34362. Following the initial discovery, the criminal entity typically referred to as cl0p took credit for the widespread exploitation of MOVEit instances.

CVE-2023-0669Pre-authentication RCE in Fortra GoAnywhere MFT License Response ServletIn the wildEvidence6

In late January 2023, the CL0P ransomware group launched a campaign using a zero-day vulnerability, now catalogued as CVE-2023-0669, to target the GoAnywhere MFT platform.

CVE-2024-55956Unauthenticated Command Injection in Cleo Harmony, VLTrader, and LexiCom Autorun DirectoryIn the wildEvidence5

TA505 (Clop) is one of the oldest groups, active since 2019... It has been exploiting the Cleo zero-day vulnerability (CVE-2024–55956) since late 2024, which makes it the most active of all groups in the first half of 2025.

CVE-2025-61884Authentication Bypass in Oracle E-Business Suite Oracle Configurator Runtime UIIn the wildEvidence5

In the months prior, Oracle issued emergency patches for E-Business Suite vulnerabilities (CVE-2025-61882, CVE-2025-61884) after active exploitation by groups such as Cl0p.

8 more CVEs tied to this actor tracked in Mallory.

IOCS

Observables

373 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.

IOC values are gated. View more in Mallory for domains, IPs, hashes, and other artifacts, or pipe them straight into your SIEM.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.
Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping55

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal46

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs13

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables373

Domains, IPs, and hashes tied to this actor, refreshed continuously.