Far from a one-trick pony, TA505’s recent documented activity hasn’t involved ransomware as the group has looked for other ways to make money.

“[T]he malware was signed mere hours prior to the attack – an indication of the operation’s deliberate timeline and nature," a Cybereason researcher said.

Proofpoint suggests that tRat is part of a trend of malware becoming more modular in order to provide attackers with more value in the long haul.

Proofpoint says the 'Marap' malware is linked to a known financially motivated threat actor group.