LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0461: SDBbot

SDBbot is a backdoor with installer and loader components that has been used by TA505 since at least 2019.[1][2]

EnterpriseS0461MalwareObject v2.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

SDBbot is a Windows backdoor with installer and loader components, reported by ATT&CK as used by TA505 since at least 2019. Its ATT&CK relationships make it operationally important because it is not just a single executable problem: the mapped behaviors cover persistence, discovery, command execution, tool transfer, proxy/C2 activity, data collection, exfiltration over C2, and evidence removal. For leaders, this is a useful test case for whether endpoint, network, identity, and incident response controls can reconstruct a Windows intrusion after the adversary has tried to blend in and clean up.

Executive priority

Prioritize SDBbot-relevant coverage where Windows systems support critical operations or sensitive data access. The mapped behaviors raise business questions about resilience and evidence quality: can the organization detect persistence through Run keys, shims, IFEO, rundll32, and DLL injection; can it see RDP-based lateral movement using valid accounts; and can it identify data staging or exfiltration over an existing C2 channel? This object is also useful for audit and readiness discussions because ATT&CK provides no official detection guidance, so local evidence of telemetry, control validation, and response playbooks becomes the main proof of preparedness.

Technical view

SOC and IR teams should validate coverage around the Windows behaviors linked to SDBbot: command execution via Windows Command Shell, rundll32 proxy execution, DLL injection, persistence through Registry Run Keys/Startup Folder, Application Shimming, and IFEO debugger configuration. Discovery coverage should include process, user, system, network configuration, location, and file/directory enumeration. Network monitoring should account for proxy use, non-application-layer protocol C2, ingress tool transfer, and exfiltration over the C2 channel. Because related behaviors include obfuscation, packing, deobfuscation, and file deletion, response procedures should assume that simple file-hash matching and post-incident artifact review may be incomplete.

Likely telemetry

  • Windows endpoint process creation and command-line telemetry
  • Windows registry modification telemetry, especially Run keys, IFEO debugger keys, and application compatibility/shim-related changes
  • Module load, DLL injection, and suspicious cross-process activity telemetry where available
  • rundll32.exe execution context, parent/child process relationships, and loaded DLL details
  • RDP logon/session telemetry and account usage records

Detection direction

  • Do not rely on a single malware signature; ATT&CK maps SDBbot to obfuscation, software packing, and deobfuscation behaviors that can reduce static-detection reliability.
  • Tune detections for suspicious combinations: Windows command shell plus discovery commands, rundll32 with unusual DLL paths or arguments, persistence registry changes followed by outbound network activity, and RDP logons followed by tool transfer or discovery.
  • Validate that endpoint telemetry captures both execution and persistence artifacts before cleanup occurs, since File Deletion and Indicator Removal are mapped behaviors.
  • Review false positives carefully for administrative tools and legitimate RDP, rundll32, registry, and discovery activity; focus on abnormal parent processes, unusual users, unusual hosts, and sequences of behavior.
  • Correlate host and network telemetry for exfiltration over C2 and proxy behavior, since either side alone may appear benign or incomplete.

Mitigation priorities

  • Harden Windows persistence surfaces by monitoring and controlling Run keys, Startup folders, IFEO debugger configuration, and application shims.
  • Limit and monitor RDP access, especially use of valid accounts across systems, with strong identity controls and reviewable session evidence.
  • Ensure endpoint protection and logging cover command shell execution, rundll32 usage, DLL/module activity, and file deletion events on critical Windows assets.
  • Restrict unnecessary outbound network paths and inspect or alert on unusual C2-like protocols, proxy behavior, and tool transfer patterns where feasible.
  • Prepare IR playbooks that preserve volatile and endpoint evidence quickly, because mapped behaviors include stealth, obfuscation, and artifact removal.
Additional notes and limits

The most decision-relevant context is the combination of SDBbot’s Windows platform, backdoor/installer/loader description, reported TA505 use since at least 2019, and the broad set of ATT&CK technique relationships. These relationships point defenders toward behavior-based validation rather than only malware-family identification. The supplied object has no official ATT&CK detection text, so detection content here is derived from the mapped techniques and should be validated against local logging, asset criticality, and normal administrative behavior.

This take uses only the supplied ATT&CK fields, external references, and relationships. It does not assert current activity, customer exposure, specific indicators, infrastructure, payload details, or guaranteed detection. Several related technique descriptions list broad or non-Windows platforms, but the SDBbot software object itself is supplied as Windows, so platform conclusions should remain Windows-focused unless local intelligence supports more.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

SDBbot

SDBbot is a backdoor with installer and loader components that has been used by TA505 since at least 2019.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

24 rows
DomainIDNameRelationship / procedure
EnterpriseT1083File and Directory Discovery

SDBbot has the ability to get directory listings or drive information on a compromised host.[1]

EnterpriseT1070Indicator Removal

SDBbot has the ability to clean up and remove data structures from a compromised host.[1]

EnterpriseT1140Deobfuscate/Decode Files or Information

SDBbot has the ability to decrypt and decompress its payload to enable code execution.[1][2]

EnterpriseT1090Proxy

SDBbot has the ability to use port forwarding to establish a proxy between a target host and C2.[1]

EnterpriseT1546.011Application ShimmingSub-technique

SDBbot has the ability to use application shimming for persistence if it detects it is running as admin on Windows XP or 7, by creating a shim database to patch services.exe.[1]

EnterpriseT1055.001Dynamic-link Library InjectionSub-technique

SDBbot has the ability to inject a downloaded DLL into a newly created rundll32.exe process.[1]

EnterpriseT1218.011Rundll32Sub-technique

SDBbot has used rundll32.exe to execute DLLs.[3]

EnterpriseT1027.002Software PackingSub-technique

SDBbot has used a packed installer file.[2]

EnterpriseT1614System Location Discovery

SDBbot can collected the country code of a compromised machine.[3]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

SDBbot has the ability to add a value to the Registry Run key to establish persistence if it detects it is running with regular user privilege. [1][2]

EnterpriseT1005Data from Local System

SDBbot has the ability to access the file system on a compromised host.[1]

EnterpriseT1021.001Remote Desktop ProtocolSub-technique

SDBbot has the ability to use RDP to connect to victim's machines.[1]

EnterpriseT1105Ingress Tool Transfer

SDBbot has the ability to download a DLL from C2 to a compromised host.[1]

EnterpriseT1082System Information Discovery

SDBbot has the ability to identify the OS version, OS bit information and computer name.[1][3]

EnterpriseT1125Video Capture

SDBbot has the ability to record video on a compromised host.[1][2]

EnterpriseT1546.012Image File Execution Options InjectionSub-technique

SDBbot has the ability to use image file execution options for persistence if it detects it is running with admin privileges on a Windows version newer than Windows 7.[1]

EnterpriseT1016System Network Configuration Discovery

SDBbot has the ability to determine the domain name and whether a proxy is configured on a compromised host.[1]

EnterpriseT1033System Owner/User Discovery

SDBbot has the ability to identify the user on a compromised host.[1]

EnterpriseT1095Non-Application Layer Protocol

SDBbot has the ability to communicate with C2 with TCP over port 443.[1]

EnterpriseT1041Exfiltration Over C2 Channel

SDBbot has sent collected data from a compromised host to its C2 servers.[3]

EnterpriseT1057Process Discovery

SDBbot can enumerate a list of running processes on a compromised machine.[3]

EnterpriseT1059.003Windows Command ShellSub-technique

SDBbot has the ability to use the command shell to execute commands on a compromised host.[1]

EnterpriseT1027Obfuscated Files or Information

SDBbot has the ability to XOR the strings for its installer component with a hardcoded 128 byte key.[1]

EnterpriseT1070.004File DeletionSub-technique

SDBbot has the ability to delete files from a compromised host.[1]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0092: TA505

TA505 is a cyber criminal group that has been active since at least 2014. TA505 is known for frequently changing malware, driving global trends in criminal malware distribution, and ransomware campaigns involving Clop.[1][2][3][4][5]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1070: Indicator RemovalEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1090: ProxyEnterpriseuses · TechniqueT1546.011: Application ShimmingEnterpriseuses · TechniqueT1055.001: Dynamic-link Library InjectionEnterpriseuses · TechniqueT1218.011: Rundll32Enterpriseuses · TechniqueT1027.002: Software PackingEnterpriseuses · TechniqueT1614: System Location DiscoveryEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1021.001: Remote Desktop ProtocolEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1125: Video CaptureEnterpriseuses · TechniqueT1546.012: Image File Execution Options InjectionEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1095: Non-Application Layer ProtocolEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · GroupG0092: TA505Enterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1027: Obfuscated Files or InformationEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
2.1
Created
Modified
Raw hash
6be836644f70a346...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.12.1Current bundle6be836644f70…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
  2. [2]
    IBM TA505 April 2020

    Frydrych, M. (2020, April 14). TA505 Continues to Infect Networks With SDBbot RAT. Retrieved May 29, 2020.

    Open source URL
  3. [3]
    Korean FSI TA505 2020

    Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.

    Open source URL
  4. [4]
    IBM TA505 April 2020

    Frydrych, M. (2020, April 14). TA505 Continues to Infect Networks With SDBbot RAT. Retrieved May 29, 2020.

    Open source URL
  5. [5]
    IBM TA505 April 2020

    Frydrych, M. (2020, April 14). TA505 Continues to Infect Networks With SDBbot RAT. Retrieved May 29, 2020.

    Open source URL
  6. [6]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
  7. [7]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
  8. [8]
    mitre-attackS0461
    Open source URL
  9. [9]
    mitre-attackS0461
    Open source URL
  10. [10]
    mitre-attackS0461
    Open source URL
  11. [11]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
  12. [12]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
  13. [13]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
  14. [14]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
  15. [15]
    IBM TA505 April 2020

    Frydrych, M. (2020, April 14). TA505 Continues to Infect Networks With SDBbot RAT. Retrieved May 29, 2020.

    Open source URL
  16. [16]
    IBM TA505 April 2020

    Frydrych, M. (2020, April 14). TA505 Continues to Infect Networks With SDBbot RAT. Retrieved May 29, 2020.

    Open source URL
  17. [17]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
  18. [18]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
  19. [19]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
  20. [20]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
  21. [21]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
  22. [22]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
  23. [23]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
  24. [24]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
  25. [25]
    Korean FSI TA505 2020

    Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.

    Open source URL
  26. [26]
    IBM TA505 April 2020

    Frydrych, M. (2020, April 14). TA505 Continues to Infect Networks With SDBbot RAT. Retrieved May 29, 2020.

    Open source URL
  27. [27]
    IBM TA505 April 2020

    Frydrych, M. (2020, April 14). TA505 Continues to Infect Networks With SDBbot RAT. Retrieved May 29, 2020.

    Open source URL
  28. [28]
    Korean FSI TA505 2020

    Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.

    Open source URL
  29. [29]
    Korean FSI TA505 2020

    Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.

    Open source URL
  30. [30]
    IBM TA505 April 2020

    Frydrych, M. (2020, April 14). TA505 Continues to Infect Networks With SDBbot RAT. Retrieved May 29, 2020.

    Open source URL
  31. [31]
    IBM TA505 April 2020

    Frydrych, M. (2020, April 14). TA505 Continues to Infect Networks With SDBbot RAT. Retrieved May 29, 2020.

    Open source URL
  32. [32]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
  33. [33]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
  34. [34]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
  35. [35]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
  36. [36]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
  37. [37]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
  38. [38]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
  39. [39]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
  40. [40]
    Korean FSI TA505 2020

    Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.

    Open source URL
  41. [41]
    Korean FSI TA505 2020

    Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.

    Open source URL
  42. [42]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
  43. [43]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
  44. [44]
    IBM TA505 April 2020

    Frydrych, M. (2020, April 14). TA505 Continues to Infect Networks With SDBbot RAT. Retrieved May 29, 2020.

    Open source URL
  45. [45]
    IBM TA505 April 2020

    Frydrych, M. (2020, April 14). TA505 Continues to Infect Networks With SDBbot RAT. Retrieved May 29, 2020.

    Open source URL
  46. [46]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
  47. [47]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
  48. [48]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
  49. [49]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
  50. [50]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
  51. [51]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
  52. [52]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
  53. [53]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
  54. [54]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
  55. [55]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
  56. [56]
    Korean FSI TA505 2020

    Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.

    Open source URL
  57. [57]
    Korean FSI TA505 2020

    Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.

    Open source URL
  58. [58]
    IBM TA505 April 2020

    Frydrych, M. (2020, April 14). TA505 Continues to Infect Networks With SDBbot RAT. Retrieved May 29, 2020.

    Open source URL
  59. [59]
    IBM TA505 April 2020

    Frydrych, M. (2020, April 14). TA505 Continues to Infect Networks With SDBbot RAT. Retrieved May 29, 2020.

    Open source URL
  60. [60]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
  61. [61]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
  62. [62]
    Korean FSI TA505 2020

    Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.

    Open source URL
  63. [63]
    Korean FSI TA505 2020

    Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.

    Open source URL
  64. [64]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
  65. [65]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
  66. [66]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use