Russian Hacker Group TA505 Found to Be Attacker of US Financial Firms. Cyberint has found evidence of remote access Trojans being used in attacks on financial entities in the United States as well as worldwide. The financially-motivated Russian-speaking threat actor group TA505 is behind the majority of these observed efforts. This group has used Shifu and Dridex in their past cybercriminal efforts, including the Locky ransomware campaigns that were observed several years ago. The campaign begins with phishing emails that have document attachments that are lures. They utilize legitimate logos, language and terminology consistent with the common business interactions.”]