Development of the activity of the TA505 cybercriminal group

This ANSSI report analyzes TA505, a prolific cybercriminal intrusion set active from 2014 through 2020, documenting its evolution from distributing banking trojans and Locky/other ransomware via the Necurs botnet to using staged loaders and backdoors (Get2, FlawedAmmyy, SDBbot, ServHelper, FlawedGrace) to achieve broad network compromise and deploy Clop ransomware; the report covers infection vectors (phishing with HTML/JS redirects), reconnaissance and lateralization (Mimikatz, Cobalt Strike, AD enumeration), infrastructure practices (short-lived domains, signed binaries, Minedoor packer), observed targets and campaigns, and likely links to other criminal groups (FIN7, Silence) and potential clients like Lazarus.