TA505

TA505 is a prolific, financially motivated cybercrime threat actor widely associated with large-scale phishing, malware delivery, credential theft, data exfiltration, and ransomware or extortion operations. The group is commonly tracked under numerous aliases including TA505, Graceful Spider, Gold Tahoe, Hive0065, Spandex Tempest, Monty Spider, Chimborazo, and Cl0p or Clop when referring to the ransomware and extortion brand linked to its later operations. Reporting has also associated parts of the actor’s activity with FIN11-related operations, though the exact relationship between TA505, FIN11, and Cl0p branding is not always consistently delineated across vendors. TA505 has historically targeted a broad cross-section of organizations worldwide and is known for opportunistic, high-volume campaigns as well as more selective intrusions against enterprises with valuable data. In more recent activity, the actor has been linked to mass exploitation of enterprise software vulnerabilities for data theft and extortion, including major campaigns against managed file transfer and Oracle enterprise application environments. The group was prominently associated with exploitation of the MOVEit Transfer zero-day CVE-2023-34362, which enabled theft from thousands of organizations and fueled one of the largest data-theft and extortion campaigns on record. It has also been linked to exploitation of Oracle E-Business Suite vulnerabilities, including CVE-2025-61882, in campaigns that reportedly affected more than 100 organizations. The actor’s tradecraft includes rapid weaponization of newly disclosed or zero-day vulnerabilities, large-scale victim enumeration, unauthorized access to internet-facing enterprise applications, account compromise, bulk data exfiltration, and follow-on extortion. TA505 and its associated Cl0p-branded operations are notable for emphasizing data theft and extortion pressure, sometimes without relying on traditional encryption-based ransomware deployment. The group has also been associated with credential access, phishing-based initial access, and use of legitimate administrative functionality and other living-off-the-land techniques to advance intrusions and evade detection. TA505 is best understood as a mature cybercriminal intrusion and extortion ecosystem rather than a nation-state actor. Its operations demonstrate strong operational tempo, adaptability, and the ability to pivot from spam and malware distribution to vulnerability-driven enterprise compromise at scale. Security professionals most commonly recognize and search for this actor as TA505, while Cl0p is the most prominent associated extortion and ransomware brand tied to its later high-profile campaigns.