SYMBOLCOMMON_NAMEaka. SYNONYMS

Gamaredon Group  (Back to overview)

aka: ACTINIUM, Actinium, Aqua Blizzard, Blue Otso, BlueAlpha, DEV-0157, G0047, Gamaredon, IRON TILDEN, PRIMITIVE BEAR, Shuckworm, Trident Ursa, UAC-0010, UNC530, Winterflounder

Unit 42 threat researchers have recently observed a threat group distributing new, custom developed malware. We have labelled this threat group the Gamaredon Group and our research shows that the Gamaredon Group has been active since at least 2013. In the past, the Gamaredon Group has relied heavily on off-the-shelf tools. Our new research shows the Gamaredon Group have made a shift to custom-developed malware. We believe this shift indicates the Gamaredon Group have improved their technical capabilities.

Associated Families
vbs.litterdrifter vbs.unidentified_003 vbs.unidentified_006 win.dilongtrash win.dinotrain apk.plain_gnome apk.bone_spy elf.evilgnome win.pteranodon win.quietsieve
References
2025-04-16 ⋅ HarfangLab ⋅ HarfangLab CTR
Inside Gamaredon’s PteroLNK: Dead Drop Resolvers and evasive Infrastructure
Pteranodon
2024-12-11 ⋅ Lookout ⋅ Kyle Schmittle, Paul Shunk
Lookout Discovers Two Russian Android Spyware Families from Gamaredon APT
BoneSpy DroidWatcher PlainGnome
2024-11-22 ⋅ cocomelonc ⋅ cocomelonc
Linux malware development 3: linux process injection with ptrace. Simple C example.
EvilGnome HiddenWasp Turla RAT
2023-11-17 ⋅ Check Point Software Technologies Ltd ⋅ Check Point Research
Malware Spotlight – Into the Trash: Analyzing LitterDrifter
LitterDrifter
2023-08-28 ⋅ National Coordination Center for Cyber Security
Gamaredon Activity amid Ukraine's Counteroffensive
Pteranodon
2023-06-15 ⋅ Symantec ⋅ Threat Hunter Team
Shuckworm: Inside Russia’s Relentless Cyber Campaign Against Ukraine
Pteranodon
2023-03-20 ⋅ ThreatMon ⋅ Seyit Sigirci (@h3xecute), ThreatMon Malware Research Team
Cybergun: Technical Analysis of the Armageddon's Infostealer
Pteranodon
2023-03-13 ⋅ ThreatMon ⋅ ThreatMon Malware Research Team
Beyond Bullets and Bombs: An Examination of Armageddon Group’s Cyber Warfare Against Ukraine
Unidentified 003 (Gamaredon Downloader) Unidentified VBS 005 (Telegram Loader) Unidentified VBS 006 (Telegram Loader) Pteranodon
2023-01-19 ⋅ Blackberry ⋅ BlackBerry Research & Intelligence Team
Gamaredon (Ab)uses Telegram to Target Ukrainian Organizations
Unidentified VBS 006 (Telegram Loader)
2022-11-21 ⋅ Blackberry ⋅ BlackBerry Research & Intelligence Team
Gamaredon Leverages Microsoft Office Docs to Target Ukraine Government and Military
Pteranodon
2022-08-10 ⋅ ⋅ Cert-UA ⋅ Cert-UA
Cyberattacks of the UAC-0010 group (Armageddon): malicious programs GammaLoad, GammaSteel (CERT-UA#5134)
Gamaredon Group
2022-07-26 ⋅ ⋅ Cert-UA ⋅ Cert-UA
UAC-0010 (Armageddon) cyberattacks using the GammaLoad.PS1_v2 malware (CERT-UA#5003,5013,5069,5071)
Gamaredon Group
2022-07-18 ⋅ Palo Alto Networks Unit 42 ⋅ Unit 42
Trident Ursa
Gamaredon Group
2022-07-18 ⋅ Palo Alto Networks Unit 42 ⋅ Unit 42
Trident Ursa
Gamaredon Group
2022-05-24 ⋅ ThreatStop ⋅ Ofir Ashman
Gamaredon Group: Understanding the Russian APT
Unidentified 003 (Gamaredon Downloader) Pteranodon
2022-05-12 ⋅ ⋅ Cert-UA ⋅ Cert-UA
Uac-0010 (Armageddon) cyberattacks using GammaLoad.PS1_v2 malware (CERT-UA#4634,4648)
Gamaredon Group
2022-05-12 ⋅ Cisco ⋅ María José Erquiaga, Onur Mustafa Erdogan
Network Footprints of Gamaredon Group
Pteranodon
2022-04-20 ⋅ Symantec ⋅ Threat Hunter Team
Shuckworm: Espionage Group Continues Intense Campaign Against Ukraine
Pteranodon
2022-04-07 ⋅ ⋅ Cert-UA ⋅ Cert-UA
Cyber attack of the UAC-0010 group (Armageddon) on the state organizations of Ukraine (CERT-UA#4434)
Gamaredon Group
2022-04-04 ⋅ ⋅ Cert-UA ⋅ Cert-UA
Cyber ​​attack of UAC-0010 group (Armageddon) on state organizations of Ukraine (CERT-UA # 4378)
Gamaredon Group
2022-04-04 ⋅ ⋅ Cert-UA ⋅ Cert-UA
Cyber attack by the UAC-0010 group (Armageddon) on state institutions of the European Union countries (CERT-UA#4334)
Gamaredon Group
2022-02-04 ⋅ Microsoft ⋅ Microsoft Digital Security Unit (DSU), Microsoft Threat Intelligence Center (MSTIC)
ACTINIUM targets Ukrainian organizations
Pteranodon Gamaredon Group
2022-02-04 ⋅ Microsoft ⋅ Microsoft Digital Security Unit (DSU), Microsoft Threat Intelligence
ACTINIUM targets Ukrainian organizations
Pteranodon QuietSieve DEV-0586
2022-02-04 ⋅ Microsoft ⋅ Microsoft Digital Security Unit (DSU), Microsoft Threat Intelligence Center (MSTIC)
ACTINIUM targets Ukrainian organizations
DilongTrash DinoTrain Pteranodon QuietSieve Gamaredon Group
2022-02-03 ⋅ Palo Alto Networks Unit 42 ⋅ Unit 42
Russia’s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine
Pteranodon Gamaredon Group
2022-02-03 ⋅ Palo Alto Networks Unit 42 ⋅ Unit 42
Russia’s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine (Updated June 22)
Pteranodon Gamaredon Group
2022-02-01 ⋅ ⋅ Cert-UA ⋅ Cert-UA
Cyber attack of the UAC-0010 group (Armageddon) on the state organizations of Ukraine (CERT-UA#3787)
Gamaredon Group
2022-01-31 ⋅ Symantec ⋅ Symantec Threat Hunter Team
Shuckworm Continues Cyber-Espionage Attacks Against Ukraine
Pteranodon Gamaredon Group
2022-01-31 ⋅ Bleeping Computer ⋅ Bill Toulas
Russian 'Gamaredon' hackers use 8 new malware payloads in attacks
Pteranodon
2021-11-04 ⋅ Security Service of Ukraine ⋅ Security Service of Ukraine
Gamaredon / Armageddon Group: FSB RF Cyber attacks against Ukraine
EvilGnome Pteranodon RMS
2021-03-03 ⋅ ⋅ Cert-UA ⋅ Cert-UA
Renewal of cyber attacks using the Pterodo hacker group Armageddon/Gamaredon
Pteranodon
2021-01-18 ⋅ aaqeel01 ⋅ Ali Aqeel
Docx Files Template-Injection
Unidentified 003 (Gamaredon Downloader)
2020-06-18 ⋅ ESET Research ⋅ Anton Cherepanov, Zuzana Hromcová
Digging up InvisiMole’s hidden arsenal
InvisiMole Gamaredon Group InvisiMole
2020-06-18 ⋅ ESET Research ⋅ Anton Cherepanov, Zuzana Hromcová
Digging up InvisiMole’s hidden arsenal
RC2FM Gamaredon Group
2020-06-16 ⋅ Intezer ⋅ Aviygayil Mechtinger
ELF Malware Analysis 101: Linux Threats No Longer an Afterthought
Cloud Snooper Dacls EvilGnome HiddenWasp MESSAGETAP NOTROBIN QNAPCrypt Winnti
2020-06-11 ⋅ ESET Research ⋅ Jean-Ian Boutin
Gamaredon group grows its game
Gamaredon Group
2020-06-11 ⋅ ESET Research ⋅ Jean-Ian Boutin
Gamaredon group grows its game
Pteranodon Gamaredon Group
2020-03-04 ⋅ CrowdStrike ⋅ CrowdStrike
2020 CrowdStrike Global Threat Report
MESSAGETAP More_eggs 8.t Dropper Anchor BabyShark BadNews Clop Cobalt Strike CobInt Cobra Carbon System Cutwail DanaBot Dharma DoppelDridex DoppelPaymer Dridex Emotet FlawedAmmyy FriedEx Gandcrab Get2 IcedID ISFB KerrDown LightNeuron LockerGoga Maze MECHANICAL Necurs Nokki Outlook Backdoor Phobos Predator The Thief QakBot REvil RobinHood Ryuk SDBbot Skipper SmokeLoader TerraRecon TerraStealer TerraTV TinyLoader TrickBot Vidar Winnti ANTHROPOID SPIDER APT23 APT31 APT39 APT40 BlackTech BuhTrap Charming Kitten CLOCKWORK SPIDER DOPPEL SPIDER FIN7 Gamaredon Group GOBLIN PANDA MONTY SPIDER MUSTANG PANDA NARWHAL SPIDER NOCTURNAL SPIDER PINCHY SPIDER SALTY SPIDER SCULLY SPIDER SMOKY SPIDER Thrip VENOM SPIDER VICEROY TIGER
2020-02-17 ⋅ Yoroi ⋅ Yoroi
Cyberwarfare: A deep dive into the latest Gamaredon Espionage Campaign
Pteranodon
2020-02-13 ⋅ Elastic ⋅ Andrew Pease, Daniel Stepanic, Seth Goodwin
Playing defense against Gamaredon Group
Pteranodon
2020-02-05 ⋅ SentinelOne ⋅ Vitali Kremez
Pro-Russian CyberSpy Gamaredon Intensifies Ukrainian Security Targeting
Pteranodon
2019-12-11 ⋅ Recorded Future ⋅ Insikt Group®
Operation Gamework: Infrastructure Overlaps Found Between BlueAlpha and Iranian APTs
Gamaredon Group
2019-09-10 ⋅ Github (StrangerealIntel) ⋅ StrangerealIntel
Gamaredon Analysis
Gamaredon Group
2019-07-17 ⋅ Intezer ⋅ Paul Litvak
EvilGnome: Rare Malware Spying on Linux Desktop Users
EvilGnome
2019-02-07 ⋅ ThreatStop ⋅ John Bambenek
An Inside Look at the Infrastructure Behind the Russian APT Gamaredon Group
Pteranodon
2019-01-07 ⋅ Vitali Kremez
Let's Learn: Deeper Dive into Gamaredon Group Pteranodon Implant Version '_512'
Pteranodon
2019-01-01 ⋅ MITRE ⋅ MITRE ATT&CK
Group description: Gamaredon Group
Gamaredon Group
2018-11-15 ⋅ ⋅ Cert-UA ⋅ Cert-UA
Виявлена підготовка до проведення кібератаки з використанням ШПЗ типу Pterodo
Pteranodon
2018-09-03 ⋅ ⋅ Cert-UA ⋅ Cert-UA
Bulk mailing of spyware like Pterodo
Pteranodon
2018-03-09 ⋅ Cert-UA ⋅ Cert-UA
Mass mailing of Pterodo-type spyware
Pteranodon
2017-05-31 ⋅ MITRE ⋅ MITRE ATT&CK
Gamaredon Group
Pteranodon Gamaredon Group
2017-02-27 ⋅ Palo Alto Networks Unit 42 ⋅ Anthony Kasza, Dominik Reichel
The Gamaredon Group Toolset Evolution
Pteranodon
2017-02-27 ⋅ Palo Alto Networks Unit 42 ⋅ Anthony Kasza, Dominik Reichel
The Gamaredon Group Toolset Evolution
Pteranodon RMS Gamaredon Group
2017-02-27 ⋅ Palo Alto Networks Unit 42 ⋅ Anthony Kasza, Dominik Reichel
The Gamaredon Group Toolset Evolution
Gamaredon Group
2017-02-27 ⋅ Palo Alto Networks Unit 42 ⋅ Anthony Kasza, Dominik Reichel
The Gamaredon Group Toolset Evolution
Gamaredon Group
2016-06-25 ⋅ NSHC ⋅ NSHC Threatrecon Team
SectorC08: Multi-Layered SFX in Recent Campaigns Target Ukraine
Pteranodon
2015-04-28 ⋅ LookingGlass ⋅ LookingGlass
Operation Armageddon: Cyber Espionage as a Strategic Component of Russian Modern Warfare
Gamaredon Group
Credits: MISP Project