TA505
Attribution profile
- Type
- Crime Syndicate
- Location
- Russia
- Known incidents
- 8 incidents
- Sources
- 259 sources
- First seen
- 2021-10-05
- Last seen
- 2025-08-13
- Updated
- 2026-10-14 21:58
- Aliases
- 4 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
The threat actor known as TA505, Lace Tempest, FIN11, and Clop is a Russian‑speaking ransomware group that operates for financial gain. It has targeted education institutions, law firms, healthcare providers, government agencies, energy companies, technology firms, and financial services across the United States, Europe, and Canada. Its typical tactics involve exploiting zero‑day vulnerabilities in file‑transfer and management software—such as MOVEit Transfer (CVE‑2023-34362), PaperCut, GoAnywhere, and Oracle E‑Business Suite (CVE‑2025-61882)—to gain access, exfiltrate data, and deploy the Clop ransomware for double‑extortion attacks. The group has been publicly linked to large‑scale campaigns including the 2023 MOVEit supply‑chain intrusion that affected over 130 organizations and millions of individuals, the 2025 Oracle E‑Business Suite zero‑day exploitation against universities such as the University of Phoenix, and earlier ransomware incidents involving PaperCut and GoAnywhere vulnerabilities. Attribution to Russia is based on the group’s language and the location noted in open‑source reporting, with no asserted state sponsorship.
Incidents
Attributed incidents are available to members.
8 incidentsSources
Sources available to members: 259 sources.