G0092
TA505 is a cyber criminal group that has been active since at least 2014. TA505 is known for frequently changing malware, driving global trends in criminal malware distribution, and ransomware campaigns involving Clop.
A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.
FBI and CISA associate CL0P campaigns with TA505. TA505 remains a separate broader cybercrime cluster because its malware distribution, botnet, access-broker, and fraud activity extends beyond Clop.
HighReviewed identity mapping approved on this date.
Reviewed identity mapping approved on this date.
Reviewed identity mapping approved on this date.
Reviewed identity mapping approved on this date.
Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.
Loading CVEs, techniques, indicators, malware, victims, and activity...