SYMBOLCOMMON_NAMEaka. SYNONYMS

Gamaredon Group  (Back to overview)

aka: ACTINIUM, Actinium, Aqua Blizzard, Blue Otso, BlueAlpha, DEV-0157, G0047, Gamaredon, IRON TILDEN, PRIMITIVE BEAR, Shuckworm, Trident Ursa, UAC-0010, UNC530, Winterflounder

Unit 42 threat researchers have recently observed a threat group distributing new, custom developed malware. We have labelled this threat group the Gamaredon Group and our research shows that the Gamaredon Group has been active since at least 2013. In the past, the Gamaredon Group has relied heavily on off-the-shelf tools. Our new research shows the Gamaredon Group have made a shift to custom-developed malware. We believe this shift indicates the Gamaredon Group have improved their technical capabilities.


Associated Families
elf.evilgnome vbs.unidentified_003 vbs.unidentified_006 win.dilongtrash win.dinotrain win.quietsieve vbs.litterdrifter win.pteranodon

References
2023-11-17Check Point Software Technologies LtdCheck Point Research
Malware Spotlight – Into the Trash: Analyzing LitterDrifter
LitterDrifter
2023-08-28National Coordination Center for Cyber Security
Gamaredon Activity amid Ukraine's Counteroffensive
Pteranodon
2023-06-15SymantecThreat Hunter Team
Shuckworm: Inside Russia’s Relentless Cyber Campaign Against Ukraine
Pteranodon
2023-03-20ThreatMonSeyit Sigirci (@h3xecute), ThreatMon Malware Research Team
Cybergun: Technical Analysis of the Armageddon's Infostealer
Pteranodon
2023-03-13ThreatMonThreatMon Malware Research Team
Beyond Bullets and Bombs: An Examination of Armageddon Group’s Cyber Warfare Against Ukraine
Unidentified 003 (Gamaredon Downloader) Unidentified VBS 005 (Telegram Loader) Unidentified VBS 006 (Telegram Loader) Pteranodon
2023-01-19BlackberryBlackBerry Research & Intelligence Team
Gamaredon (Ab)uses Telegram to Target Ukrainian Organizations
Unidentified VBS 006 (Telegram Loader)
2022-11-21BlackberryBlackBerry Research & Intelligence Team
Gamaredon Leverages Microsoft Office Docs to Target Ukraine Government and Military
Pteranodon
2022-08-10Cert-UACert-UA
Cyberattacks of the UAC-0010 group (Armageddon): malicious programs GammaLoad, GammaSteel (CERT-UA#5134)
Gamaredon Group
2022-07-26Cert-UACert-UA
UAC-0010 (Armageddon) cyberattacks using the GammaLoad.PS1_v2 malware (CERT-UA#5003,5013,5069,5071)
Gamaredon Group
2022-07-18Palo Alto Networks Unit 42Unit 42
Trident Ursa
Gamaredon Group
2022-07-18Palo Alto Networks Unit 42Unit 42
Trident Ursa
Gamaredon Group
2022-05-24ThreatStopOfir Ashman
Gamaredon Group: Understanding the Russian APT
Unidentified 003 (Gamaredon Downloader) Pteranodon
2022-05-12Cert-UACert-UA
Uac-0010 (Armageddon) cyberattacks using GammaLoad.PS1_v2 malware (CERT-UA#4634,4648)
Gamaredon Group
2022-05-12CiscoMaría José Erquiaga, Onur Mustafa Erdogan
Network Footprints of Gamaredon Group
Pteranodon
2022-04-20SymantecThreat Hunter Team
Shuckworm: Espionage Group Continues Intense Campaign Against Ukraine
Pteranodon
2022-04-07Cert-UACert-UA
Cyber attack of the UAC-0010 group (Armageddon) on the state organizations of Ukraine (CERT-UA#4434)
Gamaredon Group
2022-04-04Cert-UACert-UA
Cyber ​​attack of UAC-0010 group (Armageddon) on state organizations of Ukraine (CERT-UA # 4378)
Gamaredon Group
2022-04-04Cert-UACert-UA
Cyber attack by the UAC-0010 group (Armageddon) on state institutions of the European Union countries (CERT-UA#4334)
Gamaredon Group
2022-02-04MicrosoftMicrosoft Digital Security Unit (DSU), Microsoft Threat Intelligence Center (MSTIC)
ACTINIUM targets Ukrainian organizations
Pteranodon Gamaredon Group
2022-02-04MicrosoftMicrosoft Digital Security Unit (DSU), Microsoft Threat Intelligence Center (MSTIC)
ACTINIUM targets Ukrainian organizations
DilongTrash DinoTrain Pteranodon QuietSieve Gamaredon Group
2022-02-03Palo Alto Networks Unit 42Unit 42
Russia’s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine (Updated June 22)
Pteranodon Gamaredon Group
2022-02-03Palo Alto Networks Unit 42Unit 42
Russia’s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine
Pteranodon Gamaredon Group
2022-02-01Cert-UACert-UA
Cyber attack of the UAC-0010 group (Armageddon) on the state organizations of Ukraine (CERT-UA#3787)
Gamaredon Group
2022-01-31Bleeping ComputerBill Toulas
Russian 'Gamaredon' hackers use 8 new malware payloads in attacks
Pteranodon
2022-01-31SymantecSymantec Threat Hunter Team
Shuckworm Continues Cyber-Espionage Attacks Against Ukraine
Pteranodon Gamaredon Group
2021-11-04Security Service of UkraineSecurity Service of Ukraine
Gamaredon / Armageddon Group: FSB RF Cyber attacks against Ukraine
EvilGnome Pteranodon RMS
2021-03-03Cert-UACert-UA
Renewal of cyber attacks using the Pterodo hacker group Armageddon/Gamaredon
Pteranodon
2021-01-18aaqeel01Ali Aqeel
Docx Files Template-Injection
Unidentified 003 (Gamaredon Downloader)
2020-06-18ESET ResearchAnton Cherepanov, Zuzana Hromcová
Digging up InvisiMole’s hidden arsenal
RC2FM Gamaredon Group
2020-06-18ESET ResearchAnton Cherepanov, Zuzana Hromcová
Digging up InvisiMole’s hidden arsenal
InvisiMole Gamaredon Group InvisiMole
2020-06-16IntezerAviygayil Mechtinger
ELF Malware Analysis 101: Linux Threats No Longer an Afterthought
Cloud Snooper Dacls EvilGnome HiddenWasp MESSAGETAP NOTROBIN QNAPCrypt Winnti
2020-06-11ESET ResearchJean-Ian Boutin
Gamaredon group grows its game
Gamaredon Group
2020-06-11ESET ResearchJean-Ian Boutin
Gamaredon group grows its game
Pteranodon Gamaredon Group
2020-03-04CrowdStrikeCrowdStrike
2020 CrowdStrike Global Threat Report
MESSAGETAP More_eggs 8.t Dropper Anchor BabyShark BadNews Clop Cobalt Strike CobInt Cobra Carbon System Cutwail DanaBot Dharma DoppelDridex DoppelPaymer Dridex Emotet FlawedAmmyy FriedEx Gandcrab Get2 IcedID ISFB KerrDown LightNeuron LockerGoga Maze MECHANICAL Necurs Nokki Outlook Backdoor Phobos Predator The Thief QakBot REvil RobinHood Ryuk SDBbot Skipper SmokeLoader TerraRecon TerraStealer TerraTV TinyLoader TrickBot Vidar Winnti ANTHROPOID SPIDER APT23 APT31 APT39 APT40 BlackTech BuhTrap Charming Kitten CLOCKWORK SPIDER DOPPEL SPIDER FIN7 Gamaredon Group GOBLIN PANDA MONTY SPIDER MUSTANG PANDA NARWHAL SPIDER NOCTURNAL SPIDER PINCHY SPIDER SALTY SPIDER SCULLY SPIDER SMOKY SPIDER Thrip VENOM SPIDER VICEROY TIGER
2020-02-17YoroiYoroi
Cyberwarfare: A deep dive into the latest Gamaredon Espionage Campaign
Pteranodon
2020-02-13ElasticAndrew Pease, Daniel Stepanic, Seth Goodwin
Playing defense against Gamaredon Group
Pteranodon
2020-02-05SentinelOneVitali Kremez
Pro-Russian CyberSpy Gamaredon Intensifies Ukrainian Security Targeting
Pteranodon
2019-12-11Recorded FutureInsikt Group®
Operation Gamework: Infrastructure Overlaps Found Between BlueAlpha and Iranian APTs
Gamaredon Group
2019-09-10Github (StrangerealIntel)StrangerealIntel
Gamaredon Analysis
Gamaredon Group
2019-07-17IntezerPaul Litvak
EvilGnome: Rare Malware Spying on Linux Desktop Users
EvilGnome
2019-02-07ThreatStopJohn Bambenek
An Inside Look at the Infrastructure Behind the Russian APT Gamaredon Group
Pteranodon
2019-01-07Vitali Kremez
Let's Learn: Deeper Dive into Gamaredon Group Pteranodon Implant Version '_512'
Pteranodon
2019-01-01MITREMITRE ATT&CK
Group description: Gamaredon Group
Gamaredon Group
2018-11-15Cert-UACert-UA
Виявлена підготовка до проведення кібератаки з використанням ШПЗ типу Pterodo
Pteranodon
2018-09-03Cert-UACert-UA
Bulk mailing of spyware like Pterodo
Pteranodon
2018-03-09Cert-UACert-UA
Mass mailing of Pterodo-type spyware
Pteranodon
2017-05-31MITREMITRE ATT&CK
Gamaredon Group
Pteranodon Gamaredon Group
2017-02-27Palo Alto Networks Unit 42Anthony Kasza, Dominik Reichel
The Gamaredon Group Toolset Evolution
Gamaredon Group
2017-02-27Palo Alto Networks Unit 42Anthony Kasza, Dominik Reichel
The Gamaredon Group Toolset Evolution
Pteranodon RMS Gamaredon Group
2017-02-27Palo Alto Networks Unit 42Anthony Kasza, Dominik Reichel
The Gamaredon Group Toolset Evolution
Gamaredon Group
2017-02-27Palo Alto Networks Unit 42Anthony Kasza, Dominik Reichel
The Gamaredon Group Toolset Evolution
Pteranodon
2016-06-25NSHCNSHC Threatrecon Team
SectorC08: Multi-Layered SFX in Recent Campaigns Target Ukraine
Pteranodon
2015-04-28LookingGlassLookingGlass
Operation Armageddon: Cyber Espionage as a Strategic Component of Russian Modern Warfare
Gamaredon Group

Credits: MISP Project