Threat actor · all actors
TA505MISP-03c80674 state
🇷🇺 RU
aka SectorJ04, SectorJ04 Group, GRACEFUL SPIDER, GOLD TAHOE, Dudear, G0092, ATK103, Hive0065, CHIMBORAZO, Spandex Tempest
Last updated: 2026-06-01
1attributed CVEs
0ATT&CK techniques
4.1IDF score (tooling uniqueness)
0exclusive CVEs
2022–2023years active
About this actor
TA505, the name given by Proofpoint, has been in the cybercrime business for at least four years. This is the group behind the infamous Dridex banking trojan and Locky ransomware, delivered through malicious email campaigns via Necurs botnet. Other malware associated with TA505 include Philadelphia and GlobeImposter ransomware families.
Source: MISP threat-actor catalog
Activity timeline
Find actors who…
Profile
| CVE | Risk | CVSS | EPSS | Published | Products |
|---|---|---|---|---|---|
CVE-2022-31199 KEV | 4.3 | 9.8 | 0.0585 | 2022-11-08 | application |
Not tracked in MITRE ATT&CK (this actor has no technique associations in the STIX bundle).
Top mitigating NIST 800-53 controls (by ATT&CK technique coverage)
No mitigating-control coverage computed — actor has no MITRE ATT&CK techniques on file.
Co-occurring actors
Similar actors
Active in same years
- APT28 2.00
- Darkhotel 2.00
- APT29 2.00
- Lazarus Group 2.00
- NEODYMIUM 2.00
Same nation-state
Same category
- Night Dragon 1.00
- FunnyDream 1.00
- C0011 1.00
- Operation Wocao 1.00
- Operation Dream Job 1.00