aka: ACTINIUM, DEV-0157, Blue Otso, BlueAlpha, G0047, IRON TILDEN, PRIMITIVE BEAR, Shuckworm, Trident Ursa, UAC-0010, Winterflounder
Unit 42 threat researchers have recently observed a threat group distributing new, custom developed malware. We have labelled this threat group the Gamaredon Group and our research shows that the Gamaredon Group has been active since at least 2013. In the past, the Gamaredon Group has relied heavily on off-the-shelf tools. Our new research shows the Gamaredon Group have made a shift to custom-developed malware. We believe this shift indicates the Gamaredon Group have improved their technical capabilities.
2023-03-20 ⋅ ThreatMon ⋅ ThreatMon Malware Research Team, seyitsec @online{team:20230320:cybergun:e416155,
author = {ThreatMon Malware Research Team and seyitsec},
title = {{Cybergun: Technical Analysis of the Armageddon's Infostealer}},
date = {2023-03-20},
organization = {ThreatMon},
url = {https://threatmon.io/cybergun-technical-analysis-of-the-armageddons-infostealer/},
language = {English},
urldate = {2023-03-21}
}
Cybergun: Technical Analysis of the Armageddon's Infostealer Pteranodon |
2023-03-13 ⋅ ThreatMon ⋅ ThreatMon Malware Research Team @online{team:20230313:beyond:51d68a0,
author = {ThreatMon Malware Research Team},
title = {{Beyond Bullets and Bombs: An Examination of Armageddon Group’s Cyber Warfare Against Ukraine}},
date = {2023-03-13},
organization = {ThreatMon},
url = {https://threatmon.io/beyond-bullets-and-bombs-an-examination-of-armageddon-groups-cyber-warfare-against-ukraine/},
language = {English},
urldate = {2023-03-15}
}
Beyond Bullets and Bombs: An Examination of Armageddon Group’s Cyber Warfare Against Ukraine Unidentified 003 (Gamaredon Downloader) Unidentified VBS 005 (Telegram Loader) Unidentified VBS 006 (Telegram Loader) Pteranodon |
2023-01-19 ⋅ Blackberry ⋅ BlackBerry Research & Intelligence Team @online{team:20230119:gamaredon:ed20055,
author = {BlackBerry Research & Intelligence Team},
title = {{Gamaredon (Ab)uses Telegram to Target Ukrainian Organizations}},
date = {2023-01-19},
organization = {Blackberry},
url = {https://blogs.blackberry.com/en/2023/01/gamaredon-abuses-telegram-to-target-ukrainian-organizations},
language = {English},
urldate = {2023-01-25}
}
Gamaredon (Ab)uses Telegram to Target Ukrainian Organizations Unidentified VBS 006 (Telegram Loader) |
2022-11-21 ⋅ Blackberry ⋅ BlackBerry Research & Intelligence Team @online{team:20221121:gamaredon:da14d7a,
author = {BlackBerry Research & Intelligence Team},
title = {{Gamaredon Leverages Microsoft Office Docs to Target Ukraine Government and Military}},
date = {2022-11-21},
organization = {Blackberry},
url = {https://blogs.blackberry.com/en/2022/11/gamaredon-leverages-microsoft-office-docs-to-target-ukraine-government},
language = {English},
urldate = {2022-12-01}
}
Gamaredon Leverages Microsoft Office Docs to Target Ukraine Government and Military Pteranodon |
2022-08-10 ⋅ Cert-UA ⋅ Cert-UA @online{certua:20220810:cyberattacks:5a2c3fb,
author = {Cert-UA},
title = {{Cyberattacks of the UAC-0010 group (Armageddon): malicious programs GammaLoad, GammaSteel (CERT-UA#5134)}},
date = {2022-08-10},
organization = {Cert-UA},
url = {https://cert.gov.ua/article/1229152},
language = {Ukrainian},
urldate = {2022-08-25}
}
Cyberattacks of the UAC-0010 group (Armageddon): malicious programs GammaLoad, GammaSteel (CERT-UA#5134) Gamaredon Group |
2022-07-26 ⋅ Cert-UA ⋅ Cert-UA @online{certua:20220726:uac0010:e697f18,
author = {Cert-UA},
title = {{UAC-0010 (Armageddon) cyberattacks using the GammaLoad.PS1_v2 malware (CERT-UA#5003,5013,5069,5071)}},
date = {2022-07-26},
organization = {Cert-UA},
url = {https://cert.gov.ua/article/971405},
language = {Ukrainian},
urldate = {2022-07-28}
}
UAC-0010 (Armageddon) cyberattacks using the GammaLoad.PS1_v2 malware (CERT-UA#5003,5013,5069,5071) Gamaredon Group |
2022-07-18 ⋅ Palo Alto Networks Unit 42 ⋅ Unit 42 @online{42:20220718:trident:0e9c23b,
author = {Unit 42},
title = {{Trident Ursa}},
date = {2022-07-18},
organization = {Palo Alto Networks Unit 42},
url = {https://unit42.paloaltonetworks.com/atoms/tridentursa/},
language = {English},
urldate = {2022-07-29}
}
Trident Ursa Gamaredon Group |
2022-07-18 ⋅ Palo Alto Networks Unit 42 ⋅ Unit 42 @online{42:20220718:trident:310d54a,
author = {Unit 42},
title = {{Trident Ursa}},
date = {2022-07-18},
organization = {Palo Alto Networks Unit 42},
url = {https://unit42.paloaltonetworks.com/atoms/tridentursa},
language = {English},
urldate = {2022-08-25}
}
Trident Ursa Gamaredon Group |
2022-05-24 ⋅ ThreatStop ⋅ Ofir Ashman @online{ashman:20220524:gamaredon:7638a47,
author = {Ofir Ashman},
title = {{Gamaredon Group: Understanding the Russian APT}},
date = {2022-05-24},
organization = {ThreatStop},
url = {https://www.threatstop.com/blog/gamaredon-group-understanding-the-russian-apt},
language = {English},
urldate = {2022-05-25}
}
Gamaredon Group: Understanding the Russian APT Unidentified 003 (Gamaredon Downloader) Pteranodon |
2022-05-12 ⋅ Cert-UA ⋅ Cert-UA @online{certua:20220512:uac0010:582178b,
author = {Cert-UA},
title = {{Uac-0010 (Armageddon) cyberattacks using GammaLoad.PS1_v2 malware (CERT-UA#4634,4648)}},
date = {2022-05-12},
organization = {Cert-UA},
url = {https://cert.gov.ua/article/40240},
language = {Ukrainian},
urldate = {2022-05-17}
}
Uac-0010 (Armageddon) cyberattacks using GammaLoad.PS1_v2 malware (CERT-UA#4634,4648) Gamaredon Group |
2022-05-12 ⋅ Cisco ⋅ Onur Mustafa Erdogan, María José Erquiaga @online{erdogan:20220512:network:3befbe5,
author = {Onur Mustafa Erdogan and María José Erquiaga},
title = {{Network Footprints of Gamaredon Group}},
date = {2022-05-12},
organization = {Cisco},
url = {https://blogs.cisco.com/security/network-footprints-of-gamaredon-group},
language = {English},
urldate = {2022-05-17}
}
Network Footprints of Gamaredon Group Pteranodon |
2022-04-20 ⋅ Symantec ⋅ Threat Hunter Team @online{team:20220420:shuckworm:f7b5ef7,
author = {Threat Hunter Team},
title = {{Shuckworm: Espionage Group Continues Intense Campaign Against Ukraine}},
date = {2022-04-20},
organization = {Symantec},
url = {https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-intense-campaign-ukraine},
language = {English},
urldate = {2022-04-25}
}
Shuckworm: Espionage Group Continues Intense Campaign Against Ukraine Pteranodon |
2022-04-07 ⋅ Cert-UA ⋅ Cert-UA @online{certua:20220407:cyber:d3c5564,
author = {Cert-UA},
title = {{Cyber attack of the UAC-0010 group (Armageddon) on the state organizations of Ukraine (CERT-UA#4434)}},
date = {2022-04-07},
organization = {Cert-UA},
url = {https://cert.gov.ua/article/39386},
language = {Ukrainian},
urldate = {2022-08-25}
}
Cyber attack of the UAC-0010 group (Armageddon) on the state organizations of Ukraine (CERT-UA#4434) Gamaredon Group |
2022-04-04 ⋅ Cert-UA ⋅ Cert-UA @online{certua:20220404:cyber:d319b18,
author = {Cert-UA},
title = {{Cyber attack of UAC-0010 group (Armageddon) on state organizations of Ukraine (CERT-UA # 4378)}},
date = {2022-04-04},
organization = {Cert-UA},
url = {https://cert.gov.ua/article/39138},
language = {Ukrainian},
urldate = {2022-04-12}
}
Cyber attack of UAC-0010 group (Armageddon) on state organizations of Ukraine (CERT-UA # 4378) Gamaredon Group |
2022-04-04 ⋅ Cert-UA ⋅ Cert-UA @online{certua:20220404:cyber:76667d6,
author = {Cert-UA},
title = {{Cyber attack by the UAC-0010 group (Armageddon) on state institutions of the European Union countries (CERT-UA#4334)}},
date = {2022-04-04},
organization = {Cert-UA},
url = {https://cert.gov.ua/article/39086},
language = {Ukrainian},
urldate = {2022-08-25}
}
Cyber attack by the UAC-0010 group (Armageddon) on state institutions of the European Union countries (CERT-UA#4334) Gamaredon Group |
2022-02-04 ⋅ Microsoft ⋅ Microsoft Threat Intelligence Center (MSTIC), Microsoft Digital Security Unit (DSU) @online{mstic:20220204:actinium:739151c,
author = {Microsoft Threat Intelligence Center (MSTIC) and Microsoft Digital Security Unit (DSU)},
title = {{ACTINIUM targets Ukrainian organizations}},
date = {2022-02-04},
organization = {Microsoft},
url = {https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/},
language = {English},
urldate = {2022-02-07}
}
ACTINIUM targets Ukrainian organizations DilongTrash DinoTrain Pteranodon QuietSieve Gamaredon Group |
2022-02-04 ⋅ Microsoft ⋅ Microsoft Threat Intelligence Center (MSTIC), Microsoft Digital Security Unit (DSU) @online{mstic:20220204:actinium:46543a2,
author = {Microsoft Threat Intelligence Center (MSTIC) and Microsoft Digital Security Unit (DSU)},
title = {{ACTINIUM targets Ukrainian organizations}},
date = {2022-02-04},
organization = {Microsoft},
url = {https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations},
language = {English},
urldate = {2022-08-25}
}
ACTINIUM targets Ukrainian organizations Pteranodon Gamaredon Group |
2022-02-03 ⋅ Palo Alto Networks Unit 42 ⋅ Unit 42 @online{42:20220203:russias:cd52f9f,
author = {Unit 42},
title = {{Russia’s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine (Updated June 22)}},
date = {2022-02-03},
organization = {Palo Alto Networks Unit 42},
url = {https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021},
language = {English},
urldate = {2022-08-25}
}
Russia’s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine (Updated June 22) Pteranodon Gamaredon Group |
2022-02-03 ⋅ Palo Alto Networks Unit 42 ⋅ Unit 42 @online{42:20220203:russias:920c595,
author = {Unit 42},
title = {{Russia’s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine}},
date = {2022-02-03},
organization = {Palo Alto Networks Unit 42},
url = {https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/},
language = {English},
urldate = {2022-02-07}
}
Russia’s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine Pteranodon Gamaredon Group |
2022-02-01 ⋅ Cert-UA ⋅ Cert-UA @online{certua:20220201:cyber:5efa22c,
author = {Cert-UA},
title = {{Cyber attack of the UAC-0010 group (Armageddon) on the state organizations of Ukraine (CERT-UA#3787)}},
date = {2022-02-01},
organization = {Cert-UA},
url = {https://cert.gov.ua/article/18365},
language = {Ukrainian},
urldate = {2022-09-20}
}
Cyber attack of the UAC-0010 group (Armageddon) on the state organizations of Ukraine (CERT-UA#3787) Gamaredon Group |
2022-01-31 ⋅ Bleeping Computer ⋅ Bill Toulas @online{toulas:20220131:russian:d42b1ba,
author = {Bill Toulas},
title = {{Russian 'Gamaredon' hackers use 8 new malware payloads in attacks}},
date = {2022-01-31},
organization = {Bleeping Computer},
url = {https://www.bleepingcomputer.com/news/security/russian-gamaredon-hackers-use-8-new-malware-payloads-in-attacks/},
language = {English},
urldate = {2022-02-19}
}
Russian 'Gamaredon' hackers use 8 new malware payloads in attacks Pteranodon |
2022-01-31 ⋅ Symantec ⋅ Symantec Threat Hunter Team @online{team:20220131:shuckworm:e529180,
author = {Symantec Threat Hunter Team},
title = {{Shuckworm Continues Cyber-Espionage Attacks Against Ukraine}},
date = {2022-01-31},
organization = {Symantec},
url = {https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine},
language = {English},
urldate = {2022-02-02}
}
Shuckworm Continues Cyber-Espionage Attacks Against Ukraine Pteranodon Gamaredon Group |
2021-11-04 ⋅ Security Service of Ukraine ⋅ Security Service of Ukraine @techreport{ukraine:20211104:gamaredon:7be7543,
author = {Security Service of Ukraine},
title = {{Gamaredon / Armageddon Group: FSB RF Cyber attacks against Ukraine}},
date = {2021-11-04},
institution = {Security Service of Ukraine},
url = {https://ssu.gov.ua/uploads/files/DKIB/Technical%20report%20Armagedon.pdf},
language = {English},
urldate = {2022-03-01}
}
Gamaredon / Armageddon Group: FSB RF Cyber attacks against Ukraine EvilGnome Pteranodon RMS |
2021-01-18 ⋅ aaqeel01 ⋅ Ali Aqeel @online{aqeel:20210118:docx:aaa26f8,
author = {Ali Aqeel},
title = {{Docx Files Template-Injection}},
date = {2021-01-18},
organization = {aaqeel01},
url = {https://aaqeel01.wordpress.com/2021/01/18/docx-files-template-injection/},
language = {English},
urldate = {2021-01-21}
}
Docx Files Template-Injection Unidentified 003 (Gamaredon Downloader) |
2020-06-18 ⋅ ESET Research ⋅ Zuzana Hromcová, Anton Cherepanov @online{hromcov:20200618:digging:285d02f,
author = {Zuzana Hromcová and Anton Cherepanov},
title = {{Digging up InvisiMole’s hidden arsenal}},
date = {2020-06-18},
organization = {ESET Research},
url = {https://www.welivesecurity.com/2020/06/18/digging-up-invisimole-hidden-arsenal/},
language = {English},
urldate = {2020-06-29}
}
Digging up InvisiMole’s hidden arsenal InvisiMole Gamaredon Group InvisiMole |
2020-06-18 ⋅ ESET Research ⋅ Zuzana Hromcová, Anton Cherepanov @online{hromcov:20200618:digging:35a04cc,
author = {Zuzana Hromcová and Anton Cherepanov},
title = {{Digging up InvisiMole’s hidden arsenal}},
date = {2020-06-18},
organization = {ESET Research},
url = {https://www.welivesecurity.com/2020/06/18/digging-up-invisimole-hidden-arsenal},
language = {English},
urldate = {2022-08-25}
}
Digging up InvisiMole’s hidden arsenal RC2FM Gamaredon Group |
2020-06-16 ⋅ Intezer ⋅ Aviygayil Mechtinger @online{mechtinger:20200616:elf:7057d58,
author = {Aviygayil Mechtinger},
title = {{ELF Malware Analysis 101: Linux Threats No Longer an Afterthought}},
date = {2020-06-16},
organization = {Intezer},
url = {https://intezer.com/blog/linux/elf-malware-analysis-101-linux-threats-no-longer-an-afterthought},
language = {English},
urldate = {2020-06-16}
}
ELF Malware Analysis 101: Linux Threats No Longer an Afterthought Cloud Snooper Dacls EvilGnome HiddenWasp MESSAGETAP NOTROBIN QNAPCrypt Winnti |
2020-06-11 ⋅ ESET Research ⋅ Jean-Ian Boutin @online{boutin:20200611:gamaredon:3376ccd,
author = {Jean-Ian Boutin},
title = {{Gamaredon group grows its game}},
date = {2020-06-11},
organization = {ESET Research},
url = {https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game},
language = {English},
urldate = {2022-08-25}
}
Gamaredon group grows its game Pteranodon Gamaredon Group |
2020-06-11 ⋅ ESET Research ⋅ Jean-Ian Boutin @online{boutin:20200611:gamaredon:14a96c2,
author = {Jean-Ian Boutin},
title = {{Gamaredon group grows its game}},
date = {2020-06-11},
organization = {ESET Research},
url = {https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/},
language = {English},
urldate = {2020-06-11}
}
Gamaredon group grows its game Gamaredon Group |
2020-03-04 ⋅ CrowdStrike ⋅ CrowdStrike @techreport{crowdstrike:20200304:2020:818c85f,
author = {CrowdStrike},
title = {{2020 CrowdStrike Global Threat Report}},
date = {2020-03-04},
institution = {CrowdStrike},
url = {https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf},
language = {English},
urldate = {2020-07-24}
}
2020 CrowdStrike Global Threat Report MESSAGETAP More_eggs 8.t Dropper Anchor BabyShark BadNews Clop Cobalt Strike CobInt Cobra Carbon System Cutwail DanaBot Dharma DoppelDridex DoppelPaymer Dridex Emotet FlawedAmmyy FriedEx Gandcrab Get2 IcedID ISFB KerrDown LightNeuron LockerGoga Maze MECHANICAL Necurs Nokki Outlook Backdoor Phobos Predator The Thief QakBot REvil RobinHood Ryuk SDBbot Skipper SmokeLoader TerraRecon TerraStealer TerraTV TinyLoader TrickBot Vidar Winnti ANTHROPOID SPIDER APT23 APT31 APT39 APT40 BlackTech BuhTrap Charming Kitten CLOCKWORK SPIDER DOPPEL SPIDER FIN7 Gamaredon Group GOBLIN PANDA MONTY SPIDER MUSTANG PANDA NARWHAL SPIDER NOCTURNAL SPIDER PINCHY SPIDER SALTY SPIDER SCULLY SPIDER SMOKY SPIDER Thrip VENOM SPIDER VICEROY TIGER |
2020-02-17 ⋅ Yoroi ⋅ Yoroi @online{yoroi:20200217:cyberwarfare:5b28cf2,
author = {Yoroi},
title = {{Cyberwarfare: A deep dive into the latest Gamaredon Espionage Campaign}},
date = {2020-02-17},
organization = {Yoroi},
url = {https://blog.yoroi.company/research/cyberwarfare-a-deep-dive-into-the-latest-gamaredon-espionage-campaign/},
language = {English},
urldate = {2020-02-20}
}
Cyberwarfare: A deep dive into the latest Gamaredon Espionage Campaign Pteranodon |
2020-02-13 ⋅ Elastic ⋅ Daniel Stepanic, Andrew Pease, Seth Goodwin @online{stepanic:20200213:playing:ae77be6,
author = {Daniel Stepanic and Andrew Pease and Seth Goodwin},
title = {{Playing defense against Gamaredon Group}},
date = {2020-02-13},
organization = {Elastic},
url = {https://www.elastic.co/blog/playing-defense-against-gamaredon-group},
language = {English},
urldate = {2020-06-26}
}
Playing defense against Gamaredon Group Pteranodon |
2020-02-05 ⋅ SentinelOne ⋅ Vitali Kremez @online{kremez:20200205:prorussian:4fab984,
author = {Vitali Kremez},
title = {{Pro-Russian CyberSpy Gamaredon Intensifies Ukrainian Security Targeting}},
date = {2020-02-05},
organization = {SentinelOne},
url = {https://labs.sentinelone.com/pro-russian-cyberspy-gamaredon-intensifies-ukrainian-security-targeting/},
language = {English},
urldate = {2020-02-09}
}
Pro-Russian CyberSpy Gamaredon Intensifies Ukrainian Security Targeting Pteranodon |
2019-12-11 ⋅ Recorded Future ⋅ Insikt Group® @techreport{group:20191211:operation:beb8ce0,
author = {Insikt Group®},
title = {{Operation Gamework: Infrastructure Overlaps Found Between BlueAlpha and Iranian APTs}},
date = {2019-12-11},
institution = {Recorded Future},
url = {https://go.recordedfuture.com/hubfs/reports/cta-2019-1212.pdf},
language = {English},
urldate = {2022-08-25}
}
Operation Gamework: Infrastructure Overlaps Found Between BlueAlpha and Iranian APTs Gamaredon Group |
2019-09-10 ⋅ Github (StrangerealIntel) ⋅ StrangerealIntel @online{strangerealintel:20190910:gamaredon:282777f,
author = {StrangerealIntel},
title = {{Gamaredon Analysis}},
date = {2019-09-10},
organization = {Github (StrangerealIntel)},
url = {https://github.com/StrangerealIntel/CyberThreatIntel/tree/master/Russia/APT/Gamaredon},
language = {English},
urldate = {2020-01-09}
}
Gamaredon Analysis Gamaredon Group |
2019-07-17 ⋅ Intezer ⋅ Paul Litvak @online{litvak:20190717:evilgnome:0874eda,
author = {Paul Litvak},
title = {{EvilGnome: Rare Malware Spying on Linux Desktop Users}},
date = {2019-07-17},
organization = {Intezer},
url = {https://www.intezer.com/blog-evilgnome-rare-malware-spying-on-linux-desktop-users/},
language = {English},
urldate = {2020-01-10}
}
EvilGnome: Rare Malware Spying on Linux Desktop Users EvilGnome |
2019-02-07 ⋅ ThreatStop ⋅ John Bambenek @online{bambenek:20190207:inside:2a18c89,
author = {John Bambenek},
title = {{An Inside Look at the Infrastructure Behind the Russian APT Gamaredon Group}},
date = {2019-02-07},
organization = {ThreatStop},
url = {https://blog.threatstop.com/russian-apt-gamaredon-group},
language = {English},
urldate = {2020-01-06}
}
An Inside Look at the Infrastructure Behind the Russian APT Gamaredon Group Pteranodon |
2019-01-07 ⋅ Vitali Kremez @online{kremez:20190107:lets:07f4941,
author = {Vitali Kremez},
title = {{Let's Learn: Deeper Dive into Gamaredon Group Pteranodon Implant Version '_512'}},
date = {2019-01-07},
url = {https://www.vkremez.com/2019/01/lets-learn-deeper-dive-into-gamaredon.html},
language = {English},
urldate = {2020-01-07}
}
Let's Learn: Deeper Dive into Gamaredon Group Pteranodon Implant Version '_512' Pteranodon |
2019 ⋅ MITRE ⋅ MITRE ATT&CK @online{attck:2019:gamaredon:982ecc4,
author = {MITRE ATT&CK},
title = {{Group description: Gamaredon Group}},
date = {2019},
organization = {MITRE},
url = {https://attack.mitre.org/groups/G0047/},
language = {English},
urldate = {2019-12-20}
}
Group description: Gamaredon Group Gamaredon Group |
2018-11-15 ⋅ Cert-UA ⋅ Cert-UA @online{certua:20181115:pterodo:3ed19e5,
author = {Cert-UA},
title = {{Виявлена підготовка до проведення кібератаки з використанням ШПЗ типу Pterodo}},
date = {2018-11-15},
organization = {Cert-UA},
url = {https://cert.gov.ua/news/46},
language = {Ukrainian},
urldate = {2020-01-13}
}
Виявлена підготовка до проведення кібератаки з використанням ШПЗ типу Pterodo Pteranodon |
2018-09-03 ⋅ Cert-UA ⋅ Cert-UA @online{certua:20180903:bulk:09fa177,
author = {Cert-UA},
title = {{Bulk mailing of spyware like Pterodo}},
date = {2018-09-03},
organization = {Cert-UA},
url = {https://cert.gov.ua/news/42},
language = {Ukrainian},
urldate = {2020-01-08}
}
Bulk mailing of spyware like Pterodo Pteranodon |
2017-05-31 ⋅ MITRE ⋅ MITRE ATT&CK @online{attck:20170531:gamaredon:3f7ed54,
author = {MITRE ATT&CK},
title = {{Gamaredon Group}},
date = {2017-05-31},
organization = {MITRE},
url = {https://attack.mitre.org/groups/G0047},
language = {English},
urldate = {2022-08-25}
}
Gamaredon Group Pteranodon Gamaredon Group |
2017-02-27 ⋅ Palo Alto Networks Unit 42 ⋅ Anthony Kasza, Dominik Reichel @online{kasza:20170227:gamaredon:da1102c,
author = {Anthony Kasza and Dominik Reichel},
title = {{The Gamaredon Group Toolset Evolution}},
date = {2017-02-27},
organization = {Palo Alto Networks Unit 42},
url = {https://unit42.paloaltonetworks.com/unit-42-title-gamaredon-group-toolset-evolution},
language = {English},
urldate = {2022-08-25}
}
The Gamaredon Group Toolset Evolution Pteranodon RMS Gamaredon Group |
2017-02-27 ⋅ Palo Alto Networks Unit 42 ⋅ Anthony Kasza, Dominik Reichel @online{kasza:20170227:gamaredon:322eb5f,
author = {Anthony Kasza and Dominik Reichel},
title = {{The Gamaredon Group Toolset Evolution}},
date = {2017-02-27},
organization = {Palo Alto Networks Unit 42},
url = {https://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution/},
language = {English},
urldate = {2019-12-20}
}
The Gamaredon Group Toolset Evolution Pteranodon |
2017-02-27 ⋅ Palo Alto Networks Unit 42 ⋅ Anthony Kasza, Dominik Reichel @online{kasza:20170227:gamaredon:a88c3f8,
author = {Anthony Kasza and Dominik Reichel},
title = {{The Gamaredon Group Toolset Evolution}},
date = {2017-02-27},
organization = {Palo Alto Networks Unit 42},
url = {http://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution},
language = {English},
urldate = {2019-12-20}
}
The Gamaredon Group Toolset Evolution Gamaredon Group |
2017-02-27 ⋅ Palo Alto Networks Unit 42 ⋅ Anthony Kasza, Dominik Reichel @online{kasza:20170227:gamaredon:3d28d34,
author = {Anthony Kasza and Dominik Reichel},
title = {{The Gamaredon Group Toolset Evolution}},
date = {2017-02-27},
organization = {Palo Alto Networks Unit 42},
url = {https://unit42.paloaltonetworks.com/unit-42-title-gamaredon-group-toolset-evolution/},
language = {English},
urldate = {2020-01-09}
}
The Gamaredon Group Toolset Evolution Gamaredon Group |
2016-06-25 ⋅ NSHC ⋅ NSHC Threatrecon Team @online{team:20160625:sectorc08:84b8f56,
author = {NSHC Threatrecon Team},
title = {{SectorC08: Multi-Layered SFX in Recent Campaigns Target Ukraine}},
date = {2016-06-25},
organization = {NSHC},
url = {https://threatrecon.nshc.net/2019/06/11/sectorc08-multi-layered-sfx-recent-campaigns-target-ukraine/},
language = {English},
urldate = {2020-01-07}
}
SectorC08: Multi-Layered SFX in Recent Campaigns Target Ukraine Pteranodon |
2015-04-28 ⋅ LookingGlass ⋅ LookingGlass @techreport{lookingglass:20150428:operation:68a342f,
author = {LookingGlass},
title = {{Operation Armageddon: Cyber Espionage as a Strategic Component of Russian Modern Warfare}},
date = {2015-04-28},
institution = {LookingGlass},
url = {https://www.lookingglasscyber.com/wp-content/uploads/2015/08/Operation_Armageddon_Final.pdf},
language = {English},
urldate = {2020-01-13}
}
Operation Armageddon: Cyber Espionage as a Strategic Component of Russian Modern Warfare Gamaredon Group |