TA505

TA505 is a financially motivated cybercrime threat actor active since at least 2014 and widely associated with large-scale malware distribution, phishing-led intrusions, and ransomware deployment. The group is closely linked to the Clop/Cl0p cybercrime ecosystem and is also tracked under aliases including Graceful Spider, Gold Tahoe, Hive0065, DEV-0950, Lace Tempest, Spandex Tempest, Monty Spider, and Chimborazo. In multiple reporting streams, TA505 is described either as the broader intrusion and malware-delivery actor from which Clop operators emerged, or as overlapping personnel and affiliates involved in Clop-branded extortion operations. TA505 has historically relied on spearphishing and malicious attachments for initial access, then used loaders, commodity and custom malware, and living-off-the-land or signed-binary proxy execution techniques to establish footholds and deliver follow-on payloads. Reported tooling and malware associated with the actor include Get2, SDBbot, Truebot, Azorult, Cobalt Strike, and Clop ransomware. The group has also been observed abusing PowerShell and msiexec, and using malware acquisition and repurposing practices consistent with mature cybercrime operations. In ransomware and extortion activity, TA505 is most strongly tied to Clop operations. Those operations have evolved from conventional ransomware deployment toward large-scale data-theft extortion, including mass exploitation of internet-facing enterprise software and managed file transfer platforms. Clop-linked campaigns associated with this ecosystem have targeted products such as Accellion FTA, GoAnywhere MFT, MOVEit Transfer, Cleo file transfer software, Oracle E-Business Suite, and PTC Windchill and FlexPLM. In several of these campaigns, the actor exploited zero-day or newly disclosed vulnerabilities in public-facing applications, deployed server-side web shells, stole sensitive enterprise data, and pressured victims through leak-site publication and direct outreach. Victimology spans a broad set of sectors, with repeated targeting of government entities, manufacturing, energy, retail, healthcare, technology, and defense-adjacent organizations. Reported victim organizations and campaigns indicate a strong emphasis on large enterprises and organizations operating exposed business platforms that centralize sensitive files or operational data. The actor’s extortion methods have included both double extortion and encryption-less data-theft extortion, and Clop-linked operations have also used victim-harassment tactics such as contacting customers, partners, or employees to increase pressure. The group is widely described as Russian-speaking or Russia-linked in public reporting. Its operational profile is characteristic of a mature cybercriminal enterprise focused on monetization through credential theft, malware delivery, ransomware deployment, and increasingly industrialized exfiltration-and-extortion campaigns.