TA505

Overview

TA505 is a Russian-speaking financially motivated cybercrime group that has operated since at least 2014. The designation was assigned by Proofpoint, whose researchers identified the group as responsible for the largest malicious spam campaigns they had ever observed. Through the first several years of operation, TA505 leveraged the Necurs botnet — at the time the world's largest spam distribution infrastructure — to send tens of millions of malicious emails per day delivering Dridex banking trojans and Locky ransomware. The group's operating tempo followed a standard workweek pattern, Monday through Friday, with campaign volumes sometimes reaching tens of millions of messages in a single day.

TA505 functions as a multifaceted criminal enterprise rather than a single-purpose threat group. Its operations span industrial-scale phishing and malspam distribution, development and operation of custom malware including remote access trojans and ransomware, initial access brokering (selling network access to other criminal groups), and Ransomware-as-a-Service (RaaS) operations. The Clop ransomware operation — TA505's flagship since approximately 2019 — is considered the group's most profitable unit, having extorted an estimated $500 million or more from victims globally and directly affected more than 11,000 organizations.

The group is assessed with high confidence to be based in Russia or a Commonwealth of Independent States (CIS) country, based on multiple lines of evidence: Clop malware explicitly checks for Russian-language keyboard layouts and CIS system configurations and terminates itself if detected; code comments and group communications contain Russian-language elements; operational timing aligns with Eastern European working hours; and the group avoids targeting organizations within Russia or former Soviet states. Despite this Russian origin, TA505 has publicly denied any political or state affiliation, framing itself as a financially motivated criminal organization. No specific TA505 leadership identities have been publicly confirmed; arrests in Ukraine in June 2021 netted six suspected Clop gang members but did not disrupt the group's operations.

The defining characteristic of TA505's operational evolution is a consistent pattern of identifying the most lucrative attack surface and pivoting to exploit it at scale. In 2014–2018, that was high-volume malspam through Necurs. In 2019–2020, it was targeted enterprise ransomware using Clop. From 2020 onward, it became the systematic zero-day exploitation of enterprise file transfer platforms — a strategy the group has now executed four times against Accellion FTA, SolarWinds Serv-U, GoAnywhere MFT, and MOVEit Transfer, plus a fifth campaign against Cleo software in late 2024 that was still producing victim disclosures into 2025. By Q1 2025, Clop surpassed LockBit to become the single most prolific ransomware group by publicly disclosed breaches, with nearly 400 named victims in that quarter alone.

Target Profile

TA505 does not restrict its targeting to specific sectors or geographies in the way that many APT groups do. Proofpoint has described the group as an "equal opportunist" that pursues whatever targets offer the highest financial return at any given time. That said, distinct targeting patterns emerge across different operational phases.

• Financial Services: The primary target during the Dridex and early Clop phases. Banking institutions, payment processors, and financial services firms were prioritized for credential theft and fraud facilitation. FlawedAmmyy RAT campaigns in 2018–2019 were explicitly focused on financial sector organizations.
• Healthcare: Consistently targeted across ServHelper campaigns and Clop ransomware operations. Healthcare organizations are valued for the sensitivity of patient data, constrained security budgets, and high willingness to pay ransoms to restore operations critical to patient care.
• Government and Public Sector: Multiple US federal agencies were among the victims of the 2023 MOVEit Transfer exploitation campaign, confirmed by CISA. Government entities in North America, Europe, and Asia have been targets across multiple TA505 campaign generations.
• Enterprise File Transfer Customers: The dominant targeting category since 2020. Any organization using Accellion FTA, GoAnywhere MFT, MOVEit Transfer, or Cleo software products was at risk during the respective zero-day exploitation windows — meaning victim selection was determined by which enterprise software was being exploited rather than by sector.
• Retail and E-commerce: Heavily targeted during early Dridex campaigns for payment card data and customer credential theft. Less prominent in post-2020 operations focused on enterprise ransomware and extortion.

Tactics, Techniques & Procedures

TA505's TTPs span two distinct operational eras. The first (2014–2019) was characterized by industrial-scale malspam using Necurs. The second (2020–present) is defined by targeted enterprise exploitation and data-theft extortion. Both eras share an underlying architecture of custom tooling, rapid TTP adaptation, and financially optimized decision-making.

mitre id	technique	description
T1190	Exploit Public-Facing Application	The primary initial access method in post-2020 operations. TA505 has exploited zero-day vulnerabilities in Accellion FTA (CVE-2021-27101/27102/27103/27104), GoAnywhere MFT (CVE-2023-0669), MOVEit Transfer (CVE-2023-34362), and Cleo LexiCom/VLTrader/Harmony (CVE-2024-50623 / CVE-2024-55956). Attacks on Accellion and MOVEit were deliberately timed around US federal holidays to exploit reduced security staffing windows.
T1566.001	Spearphishing Attachment	The primary initial access method during 2014–2019. TA505 distributed hundreds of millions of malicious emails via Necurs botnet carrying macro-enabled Office documents, VBScript in ZIP and 7-Zip archives, and LNK files. Lure themes included invoices, HR notices, legal documents, banking alerts, and COVID-19 content. The group operated Monday through Friday with near-daily campaign cadence.
T1505.003	Web Shell	Custom web shells deployed on compromised file transfer appliances enable persistent server-side access independent of endpoint-based detection. DEWMODE (PHP-based) targeted Accellion FTA servers to interact with the underlying MySQL database. LEMURLOOT (C#-based) targeted MOVEit Transfer, authenticating via a hardcoded password and enabling file download, Azure settings extraction, and user account manipulation. Malichus/Cleopatra (Java-based) was deployed in Cleo attacks for reconnaissance, command execution, and data exfiltration.
T1486	Data Encrypted for Impact	Clop ransomware uses AES encryption to encrypt victim files and appends .clop or similar extensions. Early operations combined encryption with data exfiltration. From approximately 2021 onward, TA505 increasingly shifted toward data exfiltration without encryption in supply chain exploitation campaigns, prioritizing speed of data theft over the operational overhead of deploying ransomware.
T1567	Exfiltration Over Web Service	Stolen data is aggregated and exfiltrated, then published on the Tor-hosted Cl0p^_-LEAKS data leak site if ransom negotiations fail. More recently, Clop has also used torrents for data leaks, distributing stolen files through peer-to-peer networks in a manner that makes takedowns significantly more difficult for law enforcement.
T1059.001	PowerShell / Scripting Interpreter	PowerShell and Windows Command Shell are used extensively throughout TA505 attack chains for dropper execution, payload staging, lateral movement commands, and privilege escalation. LOLBins — legitimate Windows tools including PowerShell, wscript, and mshta — were adopted from 2018 onward to reduce signature-based detection footprint. CVE-2024-55956 in Cleo software was exploited specifically by manipulating the Autorun directory to execute arbitrary PowerShell and Bash commands as an unauthenticated user.
T1078	Valid Accounts / IAB Access	TA505 operates an initial access broker (IAB) function, purchasing or harvesting stolen credentials for use in its own operations and selling network access to other criminal groups. RDP credential abuse is a documented entry point for Clop ransomware deployment. The group's IAB services contribute to the broader cybercriminal ecosystem, enabling other ransomware affiliates to operate.
T1490	Inhibit System Recovery	Clop terminates processes associated with security tools, databases, and backup software before encrypting files. Batch scripts delete Volume Shadow Copies and disable Windows automatic recovery to prevent file restoration without payment. These actions maximize ransom leverage by eliminating recovery options.
T1027	Obfuscated Files / Signed Binaries	Clop binaries are digitally signed with verified certificates to appear as legitimate executables and bypass security software signature checks. TA505 uses signed payloads as a consistent evasion mechanism across multiple campaign generations. Excel 4.0 macro variants of ServHelper used signed payloads to further evade detection.
T1497	Virtualization / Sandbox Evasion	Clop malware performs a check of the system's keyboard layout and active system fonts at execution. If a Russian-language or Commonwealth of Independent States (Azerbaijan, etc.) configuration is detected, the ransomware terminates and deletes itself, protecting the operator's domestic environment from accidental self-infection.

Known Campaigns

Major confirmed operations across TA505's operational history, from the Necurs-era malspam campaigns through the Clop zero-day exploitation series.

Tools & Malware

TA505 maintains an unusually broad and continuously updated malware arsenal, reflecting sustained investment in tooling development across more than a decade of operation. Proofpoint has documented the group as a trendsetter in criminal malware distribution — tools introduced or scaled by TA505 frequently become industry-wide threats.

• Clop (Cl0p): TA505's flagship ransomware, first observed February 2019. Evolved from the CryptoMix family. Uses AES encryption, deploys digitally signed binaries, and explicitly avoids execution on Russian/CIS-language systems. Shifted from double-extortion (encrypt + leak) to pure data theft and extortion from approximately 2021 onward. Victim data published on Tor-hosted Cl0p^_-LEAKS site. The RaaS model allows affiliates to deploy Clop in exchange for a revenue share.
• Dridex: A banking trojan used as TA505's primary credential-theft payload through 2014–2018. Distributed through Necurs botnet at volumes reaching tens of millions of daily messages. Targeted online banking credentials and payment card data.
• Locky: Ransomware introduced by TA505 in 2016 that defined a new era of mass-distributed ransomware. Distributed through Necurs at unprecedented scale. Largely superseded by Clop in TA505's toolkit but remained in use through 2017–2018.
• FlawedAmmyy RAT: A remote access trojan built from leaked source code of the legitimate Ammyy Admin remote desktop application. Used for data theft, command execution, and hands-on-keyboard operator activity during targeted intrusions. Provides persistent remote access for reconnaissance, lateral movement, and data staging.
• FlawedGrace (GraceWire): A second RAT derived from the same Ammyy Admin source code lineage as FlawedAmmyy. Used alongside FlawedAmmyy in targeted campaigns and downloaded by TrueBot as a second-stage payload during later Clop deployment chains.
• ServHelper: A backdoor with multiple variants providing persistent access and payload delivery. Service-based persistence mechanism survives reboots and user logoffs. Excel 4.0 macro variants used signed payloads to evade detection. Used for credential harvesting and staging additional payloads.
• Get2: A downloader used in the Clop initial access chain, retrieving SDBot, FlawedAmmyy, FlawedGrace, and Cobalt Strike from C2 infrastructure. Typically deployed via macro-enabled Office document.
• SDBBot: A RAT deployed post-compromise via SDBot for hands-on-keyboard operations including reconnaissance and lateral movement.
• TrueBot: A first-stage downloader module used in collaboration with the Silence hacking group, capable of system information collection, screenshot capture, and downloading FlawedGrace or Cobalt Strike beacons. Associated with Clop deployment chains from 2022 onward.
• DEWMODE: PHP-based web shell deployed on compromised Accellion FTA servers during the 2020–2021 campaign. Interacted with the underlying MySQL database to enable data extraction from the appliance.
• LEMURLOOT: C#-based web shell deployed on MOVEit Transfer servers during the 2023 campaign. Masqueraded as the legitimate human.aspx file. Authenticated via hardcoded password; enabled file downloads, Azure settings extraction, and user account manipulation.
• Malichus / Cleopatra: Java-based post-exploitation framework and RAT deployed in Cleo software attacks (2024–2025). Provided reconnaissance capability, arbitrary command execution, and data exfiltration from compromised Cleo environments.
• Cobalt Strike: Commercial penetration testing tool widely abused by TA505 for post-compromise network access expansion, particularly after gaining access to Active Directory environments.

Indicators of Compromise

Key indicators from TA505 and Clop campaigns. Given the group's decade-long operational history and frequent infrastructure rotation, IOC currency must be verified before operational use.

Mitigation & Defense

Recommended controls and practices for organizations seeking to reduce exposure to TA505 and Clop ransomware operations, informed by documented TTPs across all campaign generations.

• Patch File Transfer Software Immediately: TA505's strategy centers on zero-day exploitation of managed file transfer products. Treat patches for Cleo, MOVEit Transfer, GoAnywhere MFT, and similar products as emergency priority. Apply patches within hours of release, not days — TA505's exploitation windows can be measured in days before patches are widely deployed.
• Move File Transfer Systems Behind Firewalls: Internet-exposed Cleo instances were the attack surface for the 2024–2025 campaign. Any managed file transfer product that does not require public internet exposure should be placed behind a firewall or VPN. Huntress specifically advised this as an interim mitigation during the Cleo campaign while patches were being developed.
• Disable Unnecessary Autorun and Macro Features: CVE-2024-55956 was exploited via Cleo's Autorun directory feature. Disable Autorun where not operationally required. Similarly, disable Office macro execution in environments where macros are not needed — the Necurs-era campaigns and early Clop chains relied entirely on macro-enabled documents for initial payload delivery.
• Deploy Web Application Firewalls and Inspect MFT Traffic: LEMURLOOT was identifiable by the X-siLock-Comment HTTP header. Web application firewall (WAF) rules targeting anomalous HTTP headers on MFT endpoints can detect web shell command-and-control traffic. Monitor for unusual HTTP request patterns on file transfer server applications.
• Protect and Monitor Volume Shadow Copies: Clop deletes Volume Shadow Copies as a standard pre-encryption step. Monitor for VSS deletion events (vssadmin delete shadows, wmic shadowcopy delete) as a high-fidelity ransomware pre-cursor indicator requiring immediate response.
• Block RDP Exposure: TA505 uses compromised RDP credentials for direct network access in some intrusion chains. Disallow any RDP connections directly to the internet. Require VPN or jump server for all RDP access. Enforce MFA on all remote access mechanisms.
• Validate Signed Binaries Carefully: Clop uses digitally signed binaries to appear legitimate. Security tools should be configured to validate certificate chain integrity rather than accepting signatures uncritically. Monitor for signed binaries in unexpected paths or with certificates from unfamiliar issuers.
• Immutable Offline Backups: Clop attempts to destroy or encrypt backup infrastructure. Maintain offline, immutable backups of critical data that cannot be reached by malware on the network. Test restoration procedures regularly — backup existence without tested recovery is insufficient.
• Email Security and Macro Controls: Although TA505's current primary vector is file transfer exploitation, phishing and malspam remain part of the operational toolkit. Deploy advanced email security with sandboxing for attachments, disable macro execution from internet-sourced Office documents, and train users on recognizing invoice and document lure themes.
• Monitor for TrueBot, FlawedGrace, and Cobalt Strike: These tools signal active TA505 intrusion and typically appear before Clop deployment. TrueBot C2 callbacks, FlawedGrace process injection, and Cobalt Strike beaconing are all actionable pre-ransomware indicators. Integrate behavioral signatures for these tools into EDR and SIEM platforms.

Sources & Further Reading

Attribution and references used to build this profile.

• MITRE ATT&CK — TA505 Group G0092
• Proofpoint — Threat Actor Profile: TA505, From Dridex to GlobeImposter (2017)
• CISA — AA23-158A: #StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability (2023)
• Canadian Centre for Cyber Security — Profile: TA505 / CL0P Ransomware
• Proofpoint — TA505 Ramps Activity, Delivers New FlawedGrace Variant (2021)
• Huntress — Cleo Software Actively Exploited in the Wild: CVE-2024-55956 (2024)
• Deutsche Telekom — Eager Beaver: A Short Overview of TA505 (2020)
• Barracuda — Cl0p Ransomware: The Skeezy Invader That Bites While You Sleep (2025)
• Halcyon — Cl0p Threat Group Profile (2025)
• Huntress — TA505 Threat Actor Profile