MITRE ATT&CKgroup
G0047 Gamaredon Group
- Domain
- enterprise
- Aliases
- IRON TILDEN, Primitive Bear, ACTINIUM, Armageddon, Shuckworm, DEV-0157, Aqua Blizzard, NastyShrew
- Version
- 3.4
- Created
- 2017-05-31
Description
Gamaredon Group is a suspected Russian cyber espionage group that has targeted military, law enforcement, judiciary, non-profit, and non-governmental organizations in Ukraine since at least 2013. The name Gamaredon Group derives from a misspelling of the word "Armageddon," found in early campaigns.
In November 2021, the Ukrainian government publicly attributed Gamaredon Group to Russia’s Federal Security Service (FSB) Center 18, an assessment later supported by multiple independent cybersecurity researchers.
Related
Uses · MITRE ATT&CK (76)
- T1685 Disable or Modify Tools technique
- T1027.015 Compression sub-technique
- T1027.016 Junk Code Insertion sub-technique
- T1027.012 LNK Icon Smuggling sub-technique
- T1027.010 Command Obfuscation sub-technique
- S0685 PowerPunch software (malware)
- S0686 QuietSieve software (malware)
- T1620 Reflective Code Loading technique
- T1016.001 Internet Connection Discovery sub-technique
- T1608.001 Upload Malware sub-technique
- T1583.003 Virtual Private Server sub-technique
- T1583.006 Web Services sub-technique
- T1587.003 Digital Certificates sub-technique
- T1588.002 Tool sub-technique
- T1583.001 Domains sub-technique
- T1027.004 Compile After Delivery sub-technique
- T1071.001 Web Protocols sub-technique
- T1090.003 Multi-hop Proxy sub-technique
- T1102.002 Bidirectional Communication sub-technique
- T1102.003 One-Way Communication sub-technique
- T1571 Non-Standard Port technique
- T1564.003 Hidden Window sub-technique
- T1204.001 Malicious Link sub-technique
- T1204.002 Malicious File sub-technique
- T1568.001 Fast Flux DNS sub-technique
- T1568 Dynamic Resolution technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1059.005 Visual Basic sub-technique
- T1497.001 System Checks sub-technique
References
- https://blog.cloudflare.com/2026-threat-report/ Cloudflare 2026 Threat Report New Threat Actors March 2026
- https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/ ESET Gamaredon June 2020
- https://blog.trendmicro.com/trendlabs-security-intelligence/gamaredon-apt-group-use-covid-19-lure-in-campaigns/ TrendMicro Gamaredon April 2020
- https://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution/ Palo Alto Gamaredon Feb 2017
- https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide Microsoft Threat Actor Naming July 2023
- https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/ Microsoft Actinium February 2022
- https://www.secureworks.com/research/threat-profiles/iron-tilden Secureworks IRON TILDEN Profile
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine Symantec Shuckworm January 2022
- https://www.bleepingcomputer.com/news/security/ukraine-links-members-of-gamaredon-hacker-group-to-russian-fsb/ Bleepingcomputer Gamardeon FSB November 2021
- https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/ Unit 42 Gamaredon February 2022