← All threat actors
Gamaredon GroupG0047 ↗
Unit 42 threat researchers have recently observed a threat group distributing new, custom developed malware. We have labelled this threat group the Gamaredon Group and our research shows that the Gamaredon Group has been active since at least 2013. In the past, the Gamaredon Group has relied heavily on off-the-shelf tools. Our new research shows the Gamaredon Group have made a shift to custom-developed malware.
Motivation
Unknown
Suspected origin
Russian Federation
Reports / IOCs (VT)
62 reports · 2,927 IOCs
Reported activity
2017 – 2026
Targeted industries
Government
Targeted regions
GermanyUkraine
Associated malware (14)
BoneSpyDilongTrashDinoTrainEvilGnomeGamaWiperGammDropGammaLoadLitterDrifterPlainGnomePteranodonPteroGraphinQuietSieveUnidentified 003 (Gamaredon Downloader)Unidentified VBS 006 (Telegram Loader)
CVEs seen in reporting
ATT&CK techniques in reports
- T1053 Scheduled Task/Job5
- T1060 Registry Run Keys / Startup Folder5
- T1064 Scripting5
- T1071 Application Layer Protocol5
- T1140 Deobfuscate/Decode Files or Information5
- T1204 User Execution5
- T1005 Data from Local System4
- T1025 Data from Removable Media4
- T1027 Obfuscated Files or Information4
- T1080 Taint Shared Content4
- T1083 File and Directory Discovery4
- T1085 Rundll324
- T1106 Native API4
- T1112 Modify Registry4
- T1113 Screen Capture4
- T1043 Commonly Used Port3
- T1082 System Information Discovery3
- T1105 Ingress Tool Transfer3
- T1107 File Deletion3
- T1193 Spearphishing Attachment3
Also known as
Winterflounder, ACTINIUM, Aqua Blizzard, Shuckworm, DEV-0157, Blue Otso, IRON TILDEN, UAC-0010, Trident Ursa, BlueAlpha, G0047, Actinium, PRIMITIVE BEAR