UnknownPublished 8 Feb 2021Updated 19 Apr 2026

type osint · [CERT-FR] Infrastructure d'attaque du groupe cybercriminel TA505

Affects type osintSource CIRCL OSINT Feed

TLP:WHITE, disclosure is not limited

Description

[CERT-FR] Infrastructure d'attaque du groupe cybercriminel TA505

Impact

The impact relates to the potential use of the identified infrastructure by TA505 and FIN11 for cybercriminal activities. However, no direct exploitation or compromise details are provided. The medium severity rating reflects the threat posed by these actors generally rather than a specific technical vulnerability or exploit.

Defensive guidance

Organizations should monitor threat intelligence updates regarding TA505 and FIN11 infrastructure. Standard defensive measures against known TA505 tactics may be considered, but no specific actions are mandated by this report.

Summary

The threat concerns the attack infrastructure attributed to the cybercriminal group TA505, as identified by CERT-FR through OSINT sources. The data highlights the presence and activity of TA505 and FIN11 but does not specify particular vulnerabilities, exploits, or affected products. The report categorizes the threat as medium severity based on the nature of the actors and their known activities.

Indicators of compromise

Domains 266

alpha-telemetry-microsoft.comGet2 C2 server
att-download.comPhishing server
auxin-box.comSDBbot C2 server
backup-place.comGet2 C2 server
bak-home.comGet2 C2 server
bak0-store.comGet2 C2 server
band-switch.comGet2 C2 server
box-cdn.comPhishing server
box-cnd.comPhishing server
box-en-au.comPhishing server

IP addresses 37

135.181.97.81SDBbot C2 server [2020-11-29:]
158.255.208.148SDBbot C2 server
158.255.208.168SDBbot C2 server
176.121.14.112Metasploit C2 server potentially linked to TA505 activity [2019-07-31:2019-07-31]
176.121.14.132CobaltStrike C2 server potentially linked to TA505 activity [2019-07-17:2019-08-06]
176.121.14.140CobaltStrike C2 server potentially linked to TA505 activity [2020-09-20:2021-02-04]
176.121.14.173Metasploit C2 server potentially linked to TA505 activity [2019-09-23:2019-10-01]
176.121.14.175Metasploit C2 server linked to TA505 activity [2020-03-06:2020-12-20]
176.121.14.183Metasploit C2 server potentially linked to TA505 activity [2020-03-11:2020-11-13], CobaltStrike C2 server potentially linked to TA505 activity [2020-03-13:2020-11-08]
176.121.14.197CobaltStrike C2 server potentially linked to TA505 activity [2020-11-23:2020-11-26]

Comment 6

RÃ©sultats de l'investigation sur l'infrastructure d'attaque de TA505
MontySpiderCert-IST Attack Alias
TEMP.WarlockCert-IST Attack Alias
IOC extracted from a CERT-FR report (in French) that describes the infrastructures used by TA505 from August 2019 to February 2021. It describes in particular: the types of servers used: redirection servers, phishing servers, Get2 servers, SDbot servers. the Bullet-proof hosts used : VPSSC, FlowSpec. It indicates that TA505 now often uses Clop ransomware.Cert-IST Description
SDbotCert-IST Malware Name
Get2Cert-IST Malware Name

File 1

TLP-GREEN-TA-21-008-TA505-overview.pdf

Datetime 2

2019-07-31T22:00:00+00:00Cert-IST First Seen Date
2021-02-07T23:00:00+00:00Cert-IST First Disclosed Date

Link 1

Cert-IST External link

https://wws.cert-ist.com/private/fr/IocAttack_details?format=html&objectType=ATK&ref=CERT-IST/ATK-2019.067

Text 1

Cert-IST Attack name

TA505

Community reviews

Loading reviews…