Rapport Menaces et Incidents du CERT-FR

Objet: 🇬🇧 Development of the activity of the TA505 cybercriminal group

Gestion du document

Référence	CERTFR-2020-CTI-009
Titre	🇬🇧 Development of the activity of the TA505 cybercriminal group
Date de la première version	27 août 2020
Date de la dernière version	21 septembre 2020
Source(s)
Pièce(s) jointe(s)	Aucune(s)

Tableau 1: Gestion du document

Une gestion de version détaillée se trouve à la fin de ce document.

French version: 🇫🇷

The intrusion set TA505 has been active since at least 2014 when it initially stole financial information through the use of Dridex and mass distributed ransomwares. It evolved and now conducts phishing campaigns against a wide range of businesses. Its goal is now to resell the access it gained to the information system of its victims or to encrypt it entirely to ask for a ransom.

This report provides a synthetis of ANSSI’s knowledge on TA505 to help increasing protections against it.

Indicators of compromise are available on the page CERTFR-2020-IOC-004.

DOWNLOAD THE REPORT

Gestion détaillée du document

le 21 septembre 2020: Version initiale