SYMBOLCOMMON_NAMEaka. SYNONYMS

Gamaredon Group  (Back to overview)

aka: ACTINIUM, DEV-0157, Blue Otso, BlueAlpha, G0047, IRON TILDEN, PRIMITIVE BEAR, Shuckworm, Trident Ursa, UAC-0010, Winterflounder

Unit 42 threat researchers have recently observed a threat group distributing new, custom developed malware. We have labelled this threat group the Gamaredon Group and our research shows that the Gamaredon Group has been active since at least 2013. In the past, the Gamaredon Group has relied heavily on off-the-shelf tools. Our new research shows the Gamaredon Group have made a shift to custom-developed malware. We believe this shift indicates the Gamaredon Group have improved their technical capabilities.


Associated Families
win.dilongtrash win.dinotrain win.quietsieve vbs.unidentified_003 vbs.unidentified_006 win.pteranodon elf.evilgnome

References
2023-03-20ThreatMonThreatMon Malware Research Team, seyitsec
@online{team:20230320:cybergun:e416155, author = {ThreatMon Malware Research Team and seyitsec}, title = {{Cybergun: Technical Analysis of the Armageddon's Infostealer}}, date = {2023-03-20}, organization = {ThreatMon}, url = {https://threatmon.io/cybergun-technical-analysis-of-the-armageddons-infostealer/}, language = {English}, urldate = {2023-03-21} } Cybergun: Technical Analysis of the Armageddon's Infostealer
Pteranodon
2023-03-13ThreatMonThreatMon Malware Research Team
@online{team:20230313:beyond:51d68a0, author = {ThreatMon Malware Research Team}, title = {{Beyond Bullets and Bombs: An Examination of Armageddon Group’s Cyber Warfare Against Ukraine}}, date = {2023-03-13}, organization = {ThreatMon}, url = {https://threatmon.io/beyond-bullets-and-bombs-an-examination-of-armageddon-groups-cyber-warfare-against-ukraine/}, language = {English}, urldate = {2023-03-15} } Beyond Bullets and Bombs: An Examination of Armageddon Group’s Cyber Warfare Against Ukraine
Unidentified 003 (Gamaredon Downloader) Unidentified VBS 005 (Telegram Loader) Unidentified VBS 006 (Telegram Loader) Pteranodon
2023-01-19BlackberryBlackBerry Research & Intelligence Team
@online{team:20230119:gamaredon:ed20055, author = {BlackBerry Research & Intelligence Team}, title = {{Gamaredon (Ab)uses Telegram to Target Ukrainian Organizations}}, date = {2023-01-19}, organization = {Blackberry}, url = {https://blogs.blackberry.com/en/2023/01/gamaredon-abuses-telegram-to-target-ukrainian-organizations}, language = {English}, urldate = {2023-01-25} } Gamaredon (Ab)uses Telegram to Target Ukrainian Organizations
Unidentified VBS 006 (Telegram Loader)
2022-11-21BlackberryBlackBerry Research & Intelligence Team
@online{team:20221121:gamaredon:da14d7a, author = {BlackBerry Research & Intelligence Team}, title = {{Gamaredon Leverages Microsoft Office Docs to Target Ukraine Government and Military}}, date = {2022-11-21}, organization = {Blackberry}, url = {https://blogs.blackberry.com/en/2022/11/gamaredon-leverages-microsoft-office-docs-to-target-ukraine-government}, language = {English}, urldate = {2022-12-01} } Gamaredon Leverages Microsoft Office Docs to Target Ukraine Government and Military
Pteranodon
2022-08-10Cert-UACert-UA
@online{certua:20220810:cyberattacks:5a2c3fb, author = {Cert-UA}, title = {{Cyberattacks of the UAC-0010 group (Armageddon): malicious programs GammaLoad, GammaSteel (CERT-UA#5134)}}, date = {2022-08-10}, organization = {Cert-UA}, url = {https://cert.gov.ua/article/1229152}, language = {Ukrainian}, urldate = {2022-08-25} } Cyberattacks of the UAC-0010 group (Armageddon): malicious programs GammaLoad, GammaSteel (CERT-UA#5134)
Gamaredon Group
2022-07-26Cert-UACert-UA
@online{certua:20220726:uac0010:e697f18, author = {Cert-UA}, title = {{UAC-0010 (Armageddon) cyberattacks using the GammaLoad.PS1_v2 malware (CERT-UA#5003,5013,5069,5071)}}, date = {2022-07-26}, organization = {Cert-UA}, url = {https://cert.gov.ua/article/971405}, language = {Ukrainian}, urldate = {2022-07-28} } UAC-0010 (Armageddon) cyberattacks using the GammaLoad.PS1_v2 malware (CERT-UA#5003,5013,5069,5071)
Gamaredon Group
2022-07-18Palo Alto Networks Unit 42Unit 42
@online{42:20220718:trident:0e9c23b, author = {Unit 42}, title = {{Trident Ursa}}, date = {2022-07-18}, organization = {Palo Alto Networks Unit 42}, url = {https://unit42.paloaltonetworks.com/atoms/tridentursa/}, language = {English}, urldate = {2022-07-29} } Trident Ursa
Gamaredon Group
2022-07-18Palo Alto Networks Unit 42Unit 42
@online{42:20220718:trident:310d54a, author = {Unit 42}, title = {{Trident Ursa}}, date = {2022-07-18}, organization = {Palo Alto Networks Unit 42}, url = {https://unit42.paloaltonetworks.com/atoms/tridentursa}, language = {English}, urldate = {2022-08-25} } Trident Ursa
Gamaredon Group
2022-05-24ThreatStopOfir Ashman
@online{ashman:20220524:gamaredon:7638a47, author = {Ofir Ashman}, title = {{Gamaredon Group: Understanding the Russian APT}}, date = {2022-05-24}, organization = {ThreatStop}, url = {https://www.threatstop.com/blog/gamaredon-group-understanding-the-russian-apt}, language = {English}, urldate = {2022-05-25} } Gamaredon Group: Understanding the Russian APT
Unidentified 003 (Gamaredon Downloader) Pteranodon
2022-05-12Cert-UACert-UA
@online{certua:20220512:uac0010:582178b, author = {Cert-UA}, title = {{Uac-0010 (Armageddon) cyberattacks using GammaLoad.PS1_v2 malware (CERT-UA#4634,4648)}}, date = {2022-05-12}, organization = {Cert-UA}, url = {https://cert.gov.ua/article/40240}, language = {Ukrainian}, urldate = {2022-05-17} } Uac-0010 (Armageddon) cyberattacks using GammaLoad.PS1_v2 malware (CERT-UA#4634,4648)
Gamaredon Group
2022-05-12CiscoOnur Mustafa Erdogan, María José Erquiaga
@online{erdogan:20220512:network:3befbe5, author = {Onur Mustafa Erdogan and María José Erquiaga}, title = {{Network Footprints of Gamaredon Group}}, date = {2022-05-12}, organization = {Cisco}, url = {https://blogs.cisco.com/security/network-footprints-of-gamaredon-group}, language = {English}, urldate = {2022-05-17} } Network Footprints of Gamaredon Group
Pteranodon
2022-04-20SymantecThreat Hunter Team
@online{team:20220420:shuckworm:f7b5ef7, author = {Threat Hunter Team}, title = {{Shuckworm: Espionage Group Continues Intense Campaign Against Ukraine}}, date = {2022-04-20}, organization = {Symantec}, url = {https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-intense-campaign-ukraine}, language = {English}, urldate = {2022-04-25} } Shuckworm: Espionage Group Continues Intense Campaign Against Ukraine
Pteranodon
2022-04-07Cert-UACert-UA
@online{certua:20220407:cyber:d3c5564, author = {Cert-UA}, title = {{Cyber attack of the UAC-0010 group (Armageddon) on the state organizations of Ukraine (CERT-UA#4434)}}, date = {2022-04-07}, organization = {Cert-UA}, url = {https://cert.gov.ua/article/39386}, language = {Ukrainian}, urldate = {2022-08-25} } Cyber attack of the UAC-0010 group (Armageddon) on the state organizations of Ukraine (CERT-UA#4434)
Gamaredon Group
2022-04-04Cert-UACert-UA
@online{certua:20220404:cyber:d319b18, author = {Cert-UA}, title = {{Cyber ​​attack of UAC-0010 group (Armageddon) on state organizations of Ukraine (CERT-UA # 4378)}}, date = {2022-04-04}, organization = {Cert-UA}, url = {https://cert.gov.ua/article/39138}, language = {Ukrainian}, urldate = {2022-04-12} } Cyber ​​attack of UAC-0010 group (Armageddon) on state organizations of Ukraine (CERT-UA # 4378)
Gamaredon Group
2022-04-04Cert-UACert-UA
@online{certua:20220404:cyber:76667d6, author = {Cert-UA}, title = {{Cyber attack by the UAC-0010 group (Armageddon) on state institutions of the European Union countries (CERT-UA#4334)}}, date = {2022-04-04}, organization = {Cert-UA}, url = {https://cert.gov.ua/article/39086}, language = {Ukrainian}, urldate = {2022-08-25} } Cyber attack by the UAC-0010 group (Armageddon) on state institutions of the European Union countries (CERT-UA#4334)
Gamaredon Group
2022-02-04MicrosoftMicrosoft Threat Intelligence Center (MSTIC), Microsoft Digital Security Unit (DSU)
@online{mstic:20220204:actinium:739151c, author = {Microsoft Threat Intelligence Center (MSTIC) and Microsoft Digital Security Unit (DSU)}, title = {{ACTINIUM targets Ukrainian organizations}}, date = {2022-02-04}, organization = {Microsoft}, url = {https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/}, language = {English}, urldate = {2022-02-07} } ACTINIUM targets Ukrainian organizations
DilongTrash DinoTrain Pteranodon QuietSieve Gamaredon Group
2022-02-04MicrosoftMicrosoft Threat Intelligence Center (MSTIC), Microsoft Digital Security Unit (DSU)
@online{mstic:20220204:actinium:46543a2, author = {Microsoft Threat Intelligence Center (MSTIC) and Microsoft Digital Security Unit (DSU)}, title = {{ACTINIUM targets Ukrainian organizations}}, date = {2022-02-04}, organization = {Microsoft}, url = {https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations}, language = {English}, urldate = {2022-08-25} } ACTINIUM targets Ukrainian organizations
Pteranodon Gamaredon Group
2022-02-03Palo Alto Networks Unit 42Unit 42
@online{42:20220203:russias:cd52f9f, author = {Unit 42}, title = {{Russia’s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine (Updated June 22)}}, date = {2022-02-03}, organization = {Palo Alto Networks Unit 42}, url = {https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021}, language = {English}, urldate = {2022-08-25} } Russia’s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine (Updated June 22)
Pteranodon Gamaredon Group
2022-02-03Palo Alto Networks Unit 42Unit 42
@online{42:20220203:russias:920c595, author = {Unit 42}, title = {{Russia’s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine}}, date = {2022-02-03}, organization = {Palo Alto Networks Unit 42}, url = {https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/}, language = {English}, urldate = {2022-02-07} } Russia’s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine
Pteranodon Gamaredon Group
2022-02-01Cert-UACert-UA
@online{certua:20220201:cyber:5efa22c, author = {Cert-UA}, title = {{Cyber attack of the UAC-0010 group (Armageddon) on the state organizations of Ukraine (CERT-UA#3787)}}, date = {2022-02-01}, organization = {Cert-UA}, url = {https://cert.gov.ua/article/18365}, language = {Ukrainian}, urldate = {2022-09-20} } Cyber attack of the UAC-0010 group (Armageddon) on the state organizations of Ukraine (CERT-UA#3787)
Gamaredon Group
2022-01-31Bleeping ComputerBill Toulas
@online{toulas:20220131:russian:d42b1ba, author = {Bill Toulas}, title = {{Russian 'Gamaredon' hackers use 8 new malware payloads in attacks}}, date = {2022-01-31}, organization = {Bleeping Computer}, url = {https://www.bleepingcomputer.com/news/security/russian-gamaredon-hackers-use-8-new-malware-payloads-in-attacks/}, language = {English}, urldate = {2022-02-19} } Russian 'Gamaredon' hackers use 8 new malware payloads in attacks
Pteranodon
2022-01-31SymantecSymantec Threat Hunter Team
@online{team:20220131:shuckworm:e529180, author = {Symantec Threat Hunter Team}, title = {{Shuckworm Continues Cyber-Espionage Attacks Against Ukraine}}, date = {2022-01-31}, organization = {Symantec}, url = {https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine}, language = {English}, urldate = {2022-02-02} } Shuckworm Continues Cyber-Espionage Attacks Against Ukraine
Pteranodon Gamaredon Group
2021-11-04Security Service of UkraineSecurity Service of Ukraine
@techreport{ukraine:20211104:gamaredon:7be7543, author = {Security Service of Ukraine}, title = {{Gamaredon / Armageddon Group: FSB RF Cyber attacks against Ukraine}}, date = {2021-11-04}, institution = {Security Service of Ukraine}, url = {https://ssu.gov.ua/uploads/files/DKIB/Technical%20report%20Armagedon.pdf}, language = {English}, urldate = {2022-03-01} } Gamaredon / Armageddon Group: FSB RF Cyber attacks against Ukraine
EvilGnome Pteranodon RMS
2021-01-18aaqeel01Ali Aqeel
@online{aqeel:20210118:docx:aaa26f8, author = {Ali Aqeel}, title = {{Docx Files Template-Injection}}, date = {2021-01-18}, organization = {aaqeel01}, url = {https://aaqeel01.wordpress.com/2021/01/18/docx-files-template-injection/}, language = {English}, urldate = {2021-01-21} } Docx Files Template-Injection
Unidentified 003 (Gamaredon Downloader)
2020-06-18ESET ResearchZuzana Hromcová, Anton Cherepanov
@online{hromcov:20200618:digging:285d02f, author = {Zuzana Hromcová and Anton Cherepanov}, title = {{Digging up InvisiMole’s hidden arsenal}}, date = {2020-06-18}, organization = {ESET Research}, url = {https://www.welivesecurity.com/2020/06/18/digging-up-invisimole-hidden-arsenal/}, language = {English}, urldate = {2020-06-29} } Digging up InvisiMole’s hidden arsenal
InvisiMole Gamaredon Group InvisiMole
2020-06-18ESET ResearchZuzana Hromcová, Anton Cherepanov
@online{hromcov:20200618:digging:35a04cc, author = {Zuzana Hromcová and Anton Cherepanov}, title = {{Digging up InvisiMole’s hidden arsenal}}, date = {2020-06-18}, organization = {ESET Research}, url = {https://www.welivesecurity.com/2020/06/18/digging-up-invisimole-hidden-arsenal}, language = {English}, urldate = {2022-08-25} } Digging up InvisiMole’s hidden arsenal
RC2FM Gamaredon Group
2020-06-16IntezerAviygayil Mechtinger
@online{mechtinger:20200616:elf:7057d58, author = {Aviygayil Mechtinger}, title = {{ELF Malware Analysis 101: Linux Threats No Longer an Afterthought}}, date = {2020-06-16}, organization = {Intezer}, url = {https://intezer.com/blog/linux/elf-malware-analysis-101-linux-threats-no-longer-an-afterthought}, language = {English}, urldate = {2020-06-16} } ELF Malware Analysis 101: Linux Threats No Longer an Afterthought
Cloud Snooper Dacls EvilGnome HiddenWasp MESSAGETAP NOTROBIN QNAPCrypt Winnti
2020-06-11ESET ResearchJean-Ian Boutin
@online{boutin:20200611:gamaredon:3376ccd, author = {Jean-Ian Boutin}, title = {{Gamaredon group grows its game}}, date = {2020-06-11}, organization = {ESET Research}, url = {https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game}, language = {English}, urldate = {2022-08-25} } Gamaredon group grows its game
Pteranodon Gamaredon Group
2020-06-11ESET ResearchJean-Ian Boutin
@online{boutin:20200611:gamaredon:14a96c2, author = {Jean-Ian Boutin}, title = {{Gamaredon group grows its game}}, date = {2020-06-11}, organization = {ESET Research}, url = {https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/}, language = {English}, urldate = {2020-06-11} } Gamaredon group grows its game
Gamaredon Group
2020-03-04CrowdStrikeCrowdStrike
@techreport{crowdstrike:20200304:2020:818c85f, author = {CrowdStrike}, title = {{2020 CrowdStrike Global Threat Report}}, date = {2020-03-04}, institution = {CrowdStrike}, url = {https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf}, language = {English}, urldate = {2020-07-24} } 2020 CrowdStrike Global Threat Report
MESSAGETAP More_eggs 8.t Dropper Anchor BabyShark BadNews Clop Cobalt Strike CobInt Cobra Carbon System Cutwail DanaBot Dharma DoppelDridex DoppelPaymer Dridex Emotet FlawedAmmyy FriedEx Gandcrab Get2 IcedID ISFB KerrDown LightNeuron LockerGoga Maze MECHANICAL Necurs Nokki Outlook Backdoor Phobos Predator The Thief QakBot REvil RobinHood Ryuk SDBbot Skipper SmokeLoader TerraRecon TerraStealer TerraTV TinyLoader TrickBot Vidar Winnti ANTHROPOID SPIDER APT23 APT31 APT39 APT40 BlackTech BuhTrap Charming Kitten CLOCKWORK SPIDER DOPPEL SPIDER FIN7 Gamaredon Group GOBLIN PANDA MONTY SPIDER MUSTANG PANDA NARWHAL SPIDER NOCTURNAL SPIDER PINCHY SPIDER SALTY SPIDER SCULLY SPIDER SMOKY SPIDER Thrip VENOM SPIDER VICEROY TIGER
2020-02-17YoroiYoroi
@online{yoroi:20200217:cyberwarfare:5b28cf2, author = {Yoroi}, title = {{Cyberwarfare: A deep dive into the latest Gamaredon Espionage Campaign}}, date = {2020-02-17}, organization = {Yoroi}, url = {https://blog.yoroi.company/research/cyberwarfare-a-deep-dive-into-the-latest-gamaredon-espionage-campaign/}, language = {English}, urldate = {2020-02-20} } Cyberwarfare: A deep dive into the latest Gamaredon Espionage Campaign
Pteranodon
2020-02-13ElasticDaniel Stepanic, Andrew Pease, Seth Goodwin
@online{stepanic:20200213:playing:ae77be6, author = {Daniel Stepanic and Andrew Pease and Seth Goodwin}, title = {{Playing defense against Gamaredon Group}}, date = {2020-02-13}, organization = {Elastic}, url = {https://www.elastic.co/blog/playing-defense-against-gamaredon-group}, language = {English}, urldate = {2020-06-26} } Playing defense against Gamaredon Group
Pteranodon
2020-02-05SentinelOneVitali Kremez
@online{kremez:20200205:prorussian:4fab984, author = {Vitali Kremez}, title = {{Pro-Russian CyberSpy Gamaredon Intensifies Ukrainian Security Targeting}}, date = {2020-02-05}, organization = {SentinelOne}, url = {https://labs.sentinelone.com/pro-russian-cyberspy-gamaredon-intensifies-ukrainian-security-targeting/}, language = {English}, urldate = {2020-02-09} } Pro-Russian CyberSpy Gamaredon Intensifies Ukrainian Security Targeting
Pteranodon
2019-12-11Recorded FutureInsikt Group®
@techreport{group:20191211:operation:beb8ce0, author = {Insikt Group®}, title = {{Operation Gamework: Infrastructure Overlaps Found Between BlueAlpha and Iranian APTs}}, date = {2019-12-11}, institution = {Recorded Future}, url = {https://go.recordedfuture.com/hubfs/reports/cta-2019-1212.pdf}, language = {English}, urldate = {2022-08-25} } Operation Gamework: Infrastructure Overlaps Found Between BlueAlpha and Iranian APTs
Gamaredon Group
2019-09-10Github (StrangerealIntel)StrangerealIntel
@online{strangerealintel:20190910:gamaredon:282777f, author = {StrangerealIntel}, title = {{Gamaredon Analysis}}, date = {2019-09-10}, organization = {Github (StrangerealIntel)}, url = {https://github.com/StrangerealIntel/CyberThreatIntel/tree/master/Russia/APT/Gamaredon}, language = {English}, urldate = {2020-01-09} } Gamaredon Analysis
Gamaredon Group
2019-07-17IntezerPaul Litvak
@online{litvak:20190717:evilgnome:0874eda, author = {Paul Litvak}, title = {{EvilGnome: Rare Malware Spying on Linux Desktop Users}}, date = {2019-07-17}, organization = {Intezer}, url = {https://www.intezer.com/blog-evilgnome-rare-malware-spying-on-linux-desktop-users/}, language = {English}, urldate = {2020-01-10} } EvilGnome: Rare Malware Spying on Linux Desktop Users
EvilGnome
2019-02-07ThreatStopJohn Bambenek
@online{bambenek:20190207:inside:2a18c89, author = {John Bambenek}, title = {{An Inside Look at the Infrastructure Behind the Russian APT Gamaredon Group}}, date = {2019-02-07}, organization = {ThreatStop}, url = {https://blog.threatstop.com/russian-apt-gamaredon-group}, language = {English}, urldate = {2020-01-06} } An Inside Look at the Infrastructure Behind the Russian APT Gamaredon Group
Pteranodon
2019-01-07Vitali Kremez
@online{kremez:20190107:lets:07f4941, author = {Vitali Kremez}, title = {{Let's Learn: Deeper Dive into Gamaredon Group Pteranodon Implant Version '_512'}}, date = {2019-01-07}, url = {https://www.vkremez.com/2019/01/lets-learn-deeper-dive-into-gamaredon.html}, language = {English}, urldate = {2020-01-07} } Let's Learn: Deeper Dive into Gamaredon Group Pteranodon Implant Version '_512'
Pteranodon
2019MITREMITRE ATT&CK
@online{attck:2019:gamaredon:982ecc4, author = {MITRE ATT&CK}, title = {{Group description: Gamaredon Group}}, date = {2019}, organization = {MITRE}, url = {https://attack.mitre.org/groups/G0047/}, language = {English}, urldate = {2019-12-20} } Group description: Gamaredon Group
Gamaredon Group
2018-11-15Cert-UACert-UA
@online{certua:20181115:pterodo:3ed19e5, author = {Cert-UA}, title = {{Виявлена підготовка до проведення кібератаки з використанням ШПЗ типу Pterodo}}, date = {2018-11-15}, organization = {Cert-UA}, url = {https://cert.gov.ua/news/46}, language = {Ukrainian}, urldate = {2020-01-13} } Виявлена підготовка до проведення кібератаки з використанням ШПЗ типу Pterodo
Pteranodon
2018-09-03Cert-UACert-UA
@online{certua:20180903:bulk:09fa177, author = {Cert-UA}, title = {{Bulk mailing of spyware like Pterodo}}, date = {2018-09-03}, organization = {Cert-UA}, url = {https://cert.gov.ua/news/42}, language = {Ukrainian}, urldate = {2020-01-08} } Bulk mailing of spyware like Pterodo
Pteranodon
2017-05-31MITREMITRE ATT&CK
@online{attck:20170531:gamaredon:3f7ed54, author = {MITRE ATT&CK}, title = {{Gamaredon Group}}, date = {2017-05-31}, organization = {MITRE}, url = {https://attack.mitre.org/groups/G0047}, language = {English}, urldate = {2022-08-25} } Gamaredon Group
Pteranodon Gamaredon Group
2017-02-27Palo Alto Networks Unit 42Anthony Kasza, Dominik Reichel
@online{kasza:20170227:gamaredon:da1102c, author = {Anthony Kasza and Dominik Reichel}, title = {{The Gamaredon Group Toolset Evolution}}, date = {2017-02-27}, organization = {Palo Alto Networks Unit 42}, url = {https://unit42.paloaltonetworks.com/unit-42-title-gamaredon-group-toolset-evolution}, language = {English}, urldate = {2022-08-25} } The Gamaredon Group Toolset Evolution
Pteranodon RMS Gamaredon Group
2017-02-27Palo Alto Networks Unit 42Anthony Kasza, Dominik Reichel
@online{kasza:20170227:gamaredon:322eb5f, author = {Anthony Kasza and Dominik Reichel}, title = {{The Gamaredon Group Toolset Evolution}}, date = {2017-02-27}, organization = {Palo Alto Networks Unit 42}, url = {https://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution/}, language = {English}, urldate = {2019-12-20} } The Gamaredon Group Toolset Evolution
Pteranodon
2017-02-27Palo Alto Networks Unit 42Anthony Kasza, Dominik Reichel
@online{kasza:20170227:gamaredon:a88c3f8, author = {Anthony Kasza and Dominik Reichel}, title = {{The Gamaredon Group Toolset Evolution}}, date = {2017-02-27}, organization = {Palo Alto Networks Unit 42}, url = {http://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution}, language = {English}, urldate = {2019-12-20} } The Gamaredon Group Toolset Evolution
Gamaredon Group
2017-02-27Palo Alto Networks Unit 42Anthony Kasza, Dominik Reichel
@online{kasza:20170227:gamaredon:3d28d34, author = {Anthony Kasza and Dominik Reichel}, title = {{The Gamaredon Group Toolset Evolution}}, date = {2017-02-27}, organization = {Palo Alto Networks Unit 42}, url = {https://unit42.paloaltonetworks.com/unit-42-title-gamaredon-group-toolset-evolution/}, language = {English}, urldate = {2020-01-09} } The Gamaredon Group Toolset Evolution
Gamaredon Group
2016-06-25NSHCNSHC Threatrecon Team
@online{team:20160625:sectorc08:84b8f56, author = {NSHC Threatrecon Team}, title = {{SectorC08: Multi-Layered SFX in Recent Campaigns Target Ukraine}}, date = {2016-06-25}, organization = {NSHC}, url = {https://threatrecon.nshc.net/2019/06/11/sectorc08-multi-layered-sfx-recent-campaigns-target-ukraine/}, language = {English}, urldate = {2020-01-07} } SectorC08: Multi-Layered SFX in Recent Campaigns Target Ukraine
Pteranodon
2015-04-28LookingGlassLookingGlass
@techreport{lookingglass:20150428:operation:68a342f, author = {LookingGlass}, title = {{Operation Armageddon: Cyber Espionage as a Strategic Component of Russian Modern Warfare}}, date = {2015-04-28}, institution = {LookingGlass}, url = {https://www.lookingglasscyber.com/wp-content/uploads/2015/08/Operation_Armageddon_Final.pdf}, language = {English}, urldate = {2020-01-13} } Operation Armageddon: Cyber Espionage as a Strategic Component of Russian Modern Warfare
Gamaredon Group

Credits: MISP Project