TA505

TA505 has used malware to gather credentials from Internet Explorer.^[1]

TA505 has used fast flux to mask botnets by distributing payloads across multiple IPs.^[8]

TA505 has used PowerShell to download and execute malware and reconnaissance scripts.^{[1][9][10][11]}

TA505 has used malware to disable Windows Defender.^[5]

TA505 has used HTTP to communicate with C2 nodes.^[6]

TA505 has staged malware on actor-controlled domains.^[5]

TA505 has used stolen domain admin accounts to compromise additional hosts.^[6]

TA505 has used malware to gather credentials from FTP clients and Outlook.^[1]

TA505 has used UPX to obscure malicious code.^[6]

TA505 has used lures to get users to click links in emails and attachments. For example, TA505 makes their malware look like legitimate Microsoft Word documents, .pdf and/or .lnk files. ^{[1][2][3][10][9][12][8][13]}

TA505 has used msiexec to download and execute malicious Windows Installer files.^[10][11][8]

TA505 has registered domains to impersonate services such as Dropbox to distribute malware.^[5]

TA505 has used malware such as Azorult and Cobalt Strike in their operations.^[4]

TA505 has used the tool EmailStealer to steal and send lists of e-mail addresses to a remote server.^[8]

TA505 has been seen injecting a DLL into winword.exe.^[6]

TA505 has leveraged malicious Word documents that abused DDE.^[2]

TA505 has used spearphishing emails with malicious attachments to initially compromise victims.^{[1][2][3][10][9][12][8][13][6]}

TA505 has signed payloads with code signing certificates from Thawte and Sectigo.^[10][11][8]