MULTI__2019__TA505_is_Expanding_its_Operations.pdf

The Yoroi Z-Lab report analyzes TA505 expanding its operations, detailing a sophisticated spear-phishing campaign that uses a macro-enabled Excel dropper to fetch additional payloads via SSL, including self-extracting archives that install a TektonIT RMS backdoor with registry persistence and aggressive process termination, and mapping this activity to TA505's infection patterns to indicate a broader, ongoing campaign beyond banking and retail sectors.