Gamaredon Group

    RussiaUnknown

    Observation period

    70

    Techniques

    0

    Reports

    Latest observed activity
    No dated reports available
    First observed
    —

    Profile

    Unit 42 threat researchers have recently observed a threat group distributing new, custom developed malware. We have labelled this threat group the Gamaredon Group and our research shows that the Gamaredon Group has been active since at least 2013. In the past, the Gamaredon Group has relied heavily on off-the-shelf tools. Our new research shows the Gamaredon Group have made a shift to custom-developed malware. We believe this shift indicates the Gamaredon Group have improved their technical capabilities.

    Relevance for Germany, Austria and Switzerland

    high

    Assessment based on target countries according to MISP Galaxy (CFR Cyber Operations Tracker).

    Target sectors according to source

    • Government

    Target countries according to source Ukraine, Germany

    Aliases

    • ACTINIUM
    • DEV-0157
    • Blue Otso
    • BlueAlpha
    • IRON TILDEN
    • PRIMITIVE BEAR
    • Shuckworm
    • Trident Ursa
    • UAC-0010
    • Winterflounder
    • Aqua Blizzard

    MITRE ATT&CK techniques

    Observed techniques per ATT&CK Enterprise and ICS. Each technique links to the ATT&CK knowledge base.

    Software / tooling used

    External references

    Back to group overview