aka: ACTINIUM, DEV-0157, Blue Otso, BlueAlpha, G0047, IRON TILDEN, PRIMITIVE BEAR, Shuckworm, Trident Ursa, UAC-0010, Winterflounder
Unit 42 threat researchers have recently observed a threat group distributing new, custom developed malware. We have labelled this threat group the Gamaredon Group and our research shows that the Gamaredon Group has been active since at least 2013. In the past, the Gamaredon Group has relied heavily on off-the-shelf tools. Our new research shows the Gamaredon Group have made a shift to custom-developed malware. We believe this shift indicates the Gamaredon Group have improved their technical capabilities.
2022-08-10 ⋅ Cert-UA ⋅ Cert-UA
@online{certua:20220810:cyberattacks:5a2c3fb,
author = {Cert-UA},
title = {{Cyberattacks of the UAC-0010 group (Armageddon): malicious programs GammaLoad, GammaSteel (CERT-UA#5134)}},
date = {2022-08-10},
organization = {Cert-UA},
url = {https://cert.gov.ua/article/1229152},
language = {Ukrainian},
urldate = {2022-08-25}
}
Cyberattacks of the UAC-0010 group (Armageddon): malicious programs GammaLoad, GammaSteel (CERT-UA#5134)
Gamaredon Group |
2022-07-26 ⋅ Cert-UA ⋅ Cert-UA
@online{certua:20220726:uac0010:e697f18,
author = {Cert-UA},
title = {{UAC-0010 (Armageddon) cyberattacks using the GammaLoad.PS1_v2 malware (CERT-UA#5003,5013,5069,5071)}},
date = {2022-07-26},
organization = {Cert-UA},
url = {https://cert.gov.ua/article/971405},
language = {Ukrainian},
urldate = {2022-07-28}
}
UAC-0010 (Armageddon) cyberattacks using the GammaLoad.PS1_v2 malware (CERT-UA#5003,5013,5069,5071)
Gamaredon Group |
2022-07-18 ⋅ Palo Alto Networks Unit 42 ⋅ Unit 42
@online{42:20220718:trident:0e9c23b,
author = {Unit 42},
title = {{Trident Ursa}},
date = {2022-07-18},
organization = {Palo Alto Networks Unit 42},
url = {https://unit42.paloaltonetworks.com/atoms/tridentursa/},
language = {English},
urldate = {2022-07-29}
}
Trident Ursa
Gamaredon Group |
2022-07-18 ⋅ Palo Alto Networks Unit 42 ⋅ Unit 42
@online{42:20220718:trident:310d54a,
author = {Unit 42},
title = {{Trident Ursa}},
date = {2022-07-18},
organization = {Palo Alto Networks Unit 42},
url = {https://unit42.paloaltonetworks.com/atoms/tridentursa},
language = {English},
urldate = {2022-08-25}
}
Trident Ursa
Gamaredon Group |
2022-05-24 ⋅ ThreatStop ⋅ Ofir Ashman
@online{ashman:20220524:gamaredon:7638a47,
author = {Ofir Ashman},
title = {{Gamaredon Group: Understanding the Russian APT}},
date = {2022-05-24},
organization = {ThreatStop},
url = {https://www.threatstop.com/blog/gamaredon-group-understanding-the-russian-apt},
language = {English},
urldate = {2022-05-25}
}
Gamaredon Group: Understanding the Russian APT
Unidentified 003 (Gamaredon Downloader) Pteranodon |
2022-05-12 ⋅ Cert-UA ⋅ Cert-UA
@online{certua:20220512:uac0010:582178b,
author = {Cert-UA},
title = {{Uac-0010 (Armageddon) cyberattacks using GammaLoad.PS1_v2 malware (CERT-UA#4634,4648)}},
date = {2022-05-12},
organization = {Cert-UA},
url = {https://cert.gov.ua/article/40240},
language = {Ukrainian},
urldate = {2022-05-17}
}
Uac-0010 (Armageddon) cyberattacks using GammaLoad.PS1_v2 malware (CERT-UA#4634,4648)
Gamaredon Group |
2022-05-12 ⋅ Cisco ⋅ Onur Mustafa Erdogan, María José Erquiaga
@online{erdogan:20220512:network:3befbe5,
author = {Onur Mustafa Erdogan and María José Erquiaga},
title = {{Network Footprints of Gamaredon Group}},
date = {2022-05-12},
organization = {Cisco},
url = {https://blogs.cisco.com/security/network-footprints-of-gamaredon-group},
language = {English},
urldate = {2022-05-17}
}
Network Footprints of Gamaredon Group
Pteranodon |
2022-04-20 ⋅ Symantec ⋅ Threat Hunter Team
@online{team:20220420:shuckworm:f7b5ef7,
author = {Threat Hunter Team},
title = {{Shuckworm: Espionage Group Continues Intense Campaign Against Ukraine}},
date = {2022-04-20},
organization = {Symantec},
url = {https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-intense-campaign-ukraine},
language = {English},
urldate = {2022-04-25}
}
Shuckworm: Espionage Group Continues Intense Campaign Against Ukraine
Pteranodon |
2022-04-07 ⋅ Cert-UA ⋅ Cert-UA
@online{certua:20220407:cyber:d3c5564,
author = {Cert-UA},
title = {{Cyber attack of the UAC-0010 group (Armageddon) on the state organizations of Ukraine (CERT-UA#4434)}},
date = {2022-04-07},
organization = {Cert-UA},
url = {https://cert.gov.ua/article/39386},
language = {Ukrainian},
urldate = {2022-08-25}
}
Cyber attack of the UAC-0010 group (Armageddon) on the state organizations of Ukraine (CERT-UA#4434)
Gamaredon Group |
2022-04-04 ⋅ Cert-UA ⋅ Cert-UA
@online{certua:20220404:cyber:d319b18,
author = {Cert-UA},
title = {{Cyber attack of UAC-0010 group (Armageddon) on state organizations of Ukraine (CERT-UA # 4378)}},
date = {2022-04-04},
organization = {Cert-UA},
url = {https://cert.gov.ua/article/39138},
language = {Ukrainian},
urldate = {2022-04-12}
}
Cyber attack of UAC-0010 group (Armageddon) on state organizations of Ukraine (CERT-UA # 4378)
Gamaredon Group |
2022-04-04 ⋅ Cert-UA ⋅ Cert-UA
@online{certua:20220404:cyber:76667d6,
author = {Cert-UA},
title = {{Cyber attack by the UAC-0010 group (Armageddon) on state institutions of the European Union countries (CERT-UA#4334)}},
date = {2022-04-04},
organization = {Cert-UA},
url = {https://cert.gov.ua/article/39086},
language = {Ukrainian},
urldate = {2022-08-25}
}
Cyber attack by the UAC-0010 group (Armageddon) on state institutions of the European Union countries (CERT-UA#4334)
Gamaredon Group |
2022-02-04 ⋅ Microsoft ⋅ Microsoft Threat Intelligence Center (MSTIC), Microsoft Digital Security Unit (DSU)
@online{mstic:20220204:actinium:739151c,
author = {Microsoft Threat Intelligence Center (MSTIC) and Microsoft Digital Security Unit (DSU)},
title = {{ACTINIUM targets Ukrainian organizations}},
date = {2022-02-04},
organization = {Microsoft},
url = {https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/},
language = {English},
urldate = {2022-02-07}
}
ACTINIUM targets Ukrainian organizations
DilongTrash DinoTrain Pteranodon QuietSieve Gamaredon Group |
2022-02-04 ⋅ Microsoft ⋅ Microsoft Threat Intelligence Center (MSTIC), Microsoft Digital Security Unit (DSU)
@online{mstic:20220204:actinium:46543a2,
author = {Microsoft Threat Intelligence Center (MSTIC) and Microsoft Digital Security Unit (DSU)},
title = {{ACTINIUM targets Ukrainian organizations}},
date = {2022-02-04},
organization = {Microsoft},
url = {https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations},
language = {English},
urldate = {2022-08-25}
}
ACTINIUM targets Ukrainian organizations
Pteranodon Gamaredon Group |
2022-02-03 ⋅ Palo Alto Networks Unit 42 ⋅ Unit 42
@online{42:20220203:russias:cd52f9f,
author = {Unit 42},
title = {{Russia’s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine (Updated June 22)}},
date = {2022-02-03},
organization = {Palo Alto Networks Unit 42},
url = {https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021},
language = {English},
urldate = {2022-08-25}
}
Russia’s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine (Updated June 22)
Pteranodon Gamaredon Group |
2022-02-03 ⋅ Palo Alto Networks Unit 42 ⋅ Unit 42
@online{42:20220203:russias:920c595,
author = {Unit 42},
title = {{Russia’s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine}},
date = {2022-02-03},
organization = {Palo Alto Networks Unit 42},
url = {https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/},
language = {English},
urldate = {2022-02-07}
}
Russia’s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine
Pteranodon Gamaredon Group |
2022-02-01 ⋅ Cert-UA ⋅ Cert-UA
@online{certua:20220201:cyber:5efa22c,
author = {Cert-UA},
title = {{Cyber attack of the UAC-0010 group (Armageddon) on the state organizations of Ukraine (CERT-UA#3787)}},
date = {2022-02-01},
organization = {Cert-UA},
url = {https://cert.gov.ua/article/18365},
language = {Ukrainian},
urldate = {2022-09-20}
}
Cyber attack of the UAC-0010 group (Armageddon) on the state organizations of Ukraine (CERT-UA#3787)
Gamaredon Group |
2022-01-31 ⋅ Bleeping Computer ⋅ Bill Toulas
@online{toulas:20220131:russian:d42b1ba,
author = {Bill Toulas},
title = {{Russian 'Gamaredon' hackers use 8 new malware payloads in attacks}},
date = {2022-01-31},
organization = {Bleeping Computer},
url = {https://www.bleepingcomputer.com/news/security/russian-gamaredon-hackers-use-8-new-malware-payloads-in-attacks/},
language = {English},
urldate = {2022-02-19}
}
Russian 'Gamaredon' hackers use 8 new malware payloads in attacks
Pteranodon |
2022-01-31 ⋅ Symantec ⋅ Symantec Threat Hunter Team
@online{team:20220131:shuckworm:e529180,
author = {Symantec Threat Hunter Team},
title = {{Shuckworm Continues Cyber-Espionage Attacks Against Ukraine}},
date = {2022-01-31},
organization = {Symantec},
url = {https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine},
language = {English},
urldate = {2022-02-02}
}
Shuckworm Continues Cyber-Espionage Attacks Against Ukraine
Pteranodon Gamaredon Group |
2021-11-04 ⋅ Security Service of Ukraine ⋅ Security Service of Ukraine
@techreport{ukraine:20211104:gamaredon:7be7543,
author = {Security Service of Ukraine},
title = {{Gamaredon / Armageddon Group: FSB RF Cyber attacks against Ukraine}},
date = {2021-11-04},
institution = {Security Service of Ukraine},
url = {https://ssu.gov.ua/uploads/files/DKIB/Technical%20report%20Armagedon.pdf},
language = {English},
urldate = {2022-03-01}
}
Gamaredon / Armageddon Group: FSB RF Cyber attacks against Ukraine
EvilGnome Pteranodon RMS |
2021-01-18 ⋅ aaqeel01 ⋅ Ali Aqeel
@online{aqeel:20210118:docx:aaa26f8,
author = {Ali Aqeel},
title = {{Docx Files Template-Injection}},
date = {2021-01-18},
organization = {aaqeel01},
url = {https://aaqeel01.wordpress.com/2021/01/18/docx-files-template-injection/},
language = {English},
urldate = {2021-01-21}
}
Docx Files Template-Injection
Unidentified 003 (Gamaredon Downloader) |
2020-06-18 ⋅ ESET Research ⋅ Zuzana Hromcová, Anton Cherepanov
@online{hromcov:20200618:digging:285d02f,
author = {Zuzana Hromcová and Anton Cherepanov},
title = {{Digging up InvisiMole’s hidden arsenal}},
date = {2020-06-18},
organization = {ESET Research},
url = {https://www.welivesecurity.com/2020/06/18/digging-up-invisimole-hidden-arsenal/},
language = {English},
urldate = {2020-06-29}
}
Digging up InvisiMole’s hidden arsenal
InvisiMole Gamaredon Group InvisiMole |
2020-06-18 ⋅ ESET Research ⋅ Zuzana Hromcová, Anton Cherepanov
@online{hromcov:20200618:digging:35a04cc,
author = {Zuzana Hromcová and Anton Cherepanov},
title = {{Digging up InvisiMole’s hidden arsenal}},
date = {2020-06-18},
organization = {ESET Research},
url = {https://www.welivesecurity.com/2020/06/18/digging-up-invisimole-hidden-arsenal},
language = {English},
urldate = {2022-08-25}
}
Digging up InvisiMole’s hidden arsenal
RC2FM Gamaredon Group |
2020-06-16 ⋅ Intezer ⋅ Aviygayil Mechtinger
@online{mechtinger:20200616:elf:7057d58,
author = {Aviygayil Mechtinger},
title = {{ELF Malware Analysis 101: Linux Threats No Longer an Afterthought}},
date = {2020-06-16},
organization = {Intezer},
url = {https://intezer.com/blog/linux/elf-malware-analysis-101-linux-threats-no-longer-an-afterthought},
language = {English},
urldate = {2020-06-16}
}
ELF Malware Analysis 101: Linux Threats No Longer an Afterthought
Cloud Snooper Dacls EvilGnome HiddenWasp MESSAGETAP NOTROBIN QNAPCrypt Winnti |
2020-06-11 ⋅ ESET Research ⋅ Jean-Ian Boutin
@online{boutin:20200611:gamaredon:3376ccd,
author = {Jean-Ian Boutin},
title = {{Gamaredon group grows its game}},
date = {2020-06-11},
organization = {ESET Research},
url = {https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game},
language = {English},
urldate = {2022-08-25}
}
Gamaredon group grows its game
Pteranodon Gamaredon Group |
2020-06-11 ⋅ ESET Research ⋅ Jean-Ian Boutin
@online{boutin:20200611:gamaredon:14a96c2,
author = {Jean-Ian Boutin},
title = {{Gamaredon group grows its game}},
date = {2020-06-11},
organization = {ESET Research},
url = {https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/},
language = {English},
urldate = {2020-06-11}
}
Gamaredon group grows its game
Gamaredon Group |
2020-03-04 ⋅ CrowdStrike ⋅ CrowdStrike
@techreport{crowdstrike:20200304:2020:818c85f,
author = {CrowdStrike},
title = {{2020 CrowdStrike Global Threat Report}},
date = {2020-03-04},
institution = {CrowdStrike},
url = {https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf},
language = {English},
urldate = {2020-07-24}
}
2020 CrowdStrike Global Threat Report
MESSAGETAP More_eggs 8.t Dropper Anchor BabyShark BadNews Clop Cobalt Strike CobInt Cobra Carbon System Cutwail DanaBot Dharma DoppelDridex DoppelPaymer Dridex Emotet FlawedAmmyy FriedEx Gandcrab Get2 IcedID ISFB KerrDown LightNeuron LockerGoga Maze MECHANICAL Necurs Nokki Outlook Backdoor Phobos Predator The Thief QakBot REvil RobinHood Ryuk SDBbot Skipper SmokeLoader TerraRecon TerraStealer TerraTV TinyLoader TrickBot Vidar Winnti ANTHROPOID SPIDER APT23 APT31 APT39 APT40 BlackTech BuhTrap Charming Kitten CLOCKWORK SPIDER DOPPEL SPIDER FIN7 Gamaredon Group GOBLIN PANDA MONTY SPIDER MUSTANG PANDA NARWHAL SPIDER NOCTURNAL SPIDER PINCHY SPIDER SALTY SPIDER SCULLY SPIDER SMOKY SPIDER Thrip VENOM SPIDER VICEROY TIGER |
2020-02-17 ⋅ Yoroi ⋅ Yoroi
@online{yoroi:20200217:cyberwarfare:5b28cf2,
author = {Yoroi},
title = {{Cyberwarfare: A deep dive into the latest Gamaredon Espionage Campaign}},
date = {2020-02-17},
organization = {Yoroi},
url = {https://blog.yoroi.company/research/cyberwarfare-a-deep-dive-into-the-latest-gamaredon-espionage-campaign/},
language = {English},
urldate = {2020-02-20}
}
Cyberwarfare: A deep dive into the latest Gamaredon Espionage Campaign
Pteranodon |
2020-02-13 ⋅ Elastic ⋅ Daniel Stepanic, Andrew Pease, Seth Goodwin
@online{stepanic:20200213:playing:ae77be6,
author = {Daniel Stepanic and Andrew Pease and Seth Goodwin},
title = {{Playing defense against Gamaredon Group}},
date = {2020-02-13},
organization = {Elastic},
url = {https://www.elastic.co/blog/playing-defense-against-gamaredon-group},
language = {English},
urldate = {2020-06-26}
}
Playing defense against Gamaredon Group
Pteranodon |
2020-02-05 ⋅ SentinelOne ⋅ Vitali Kremez
@online{kremez:20200205:prorussian:4fab984,
author = {Vitali Kremez},
title = {{Pro-Russian CyberSpy Gamaredon Intensifies Ukrainian Security Targeting}},
date = {2020-02-05},
organization = {SentinelOne},
url = {https://labs.sentinelone.com/pro-russian-cyberspy-gamaredon-intensifies-ukrainian-security-targeting/},
language = {English},
urldate = {2020-02-09}
}
Pro-Russian CyberSpy Gamaredon Intensifies Ukrainian Security Targeting
Pteranodon |
2019-12-11 ⋅ Recorded Future ⋅ Insikt Group®
@techreport{group:20191211:operation:beb8ce0,
author = {Insikt Group®},
title = {{Operation Gamework: Infrastructure Overlaps Found Between BlueAlpha and Iranian APTs}},
date = {2019-12-11},
institution = {Recorded Future},
url = {https://go.recordedfuture.com/hubfs/reports/cta-2019-1212.pdf},
language = {English},
urldate = {2022-08-25}
}
Operation Gamework: Infrastructure Overlaps Found Between BlueAlpha and Iranian APTs
Gamaredon Group |
2019-09-10 ⋅ Github (StrangerealIntel) ⋅ StrangerealIntel
@online{strangerealintel:20190910:gamaredon:282777f,
author = {StrangerealIntel},
title = {{Gamaredon Analysis}},
date = {2019-09-10},
organization = {Github (StrangerealIntel)},
url = {https://github.com/StrangerealIntel/CyberThreatIntel/tree/master/Russia/APT/Gamaredon},
language = {English},
urldate = {2020-01-09}
}
Gamaredon Analysis
Gamaredon Group |
2019-07-17 ⋅ Intezer ⋅ Paul Litvak
@online{litvak:20190717:evilgnome:0874eda,
author = {Paul Litvak},
title = {{EvilGnome: Rare Malware Spying on Linux Desktop Users}},
date = {2019-07-17},
organization = {Intezer},
url = {https://www.intezer.com/blog-evilgnome-rare-malware-spying-on-linux-desktop-users/},
language = {English},
urldate = {2020-01-10}
}
EvilGnome: Rare Malware Spying on Linux Desktop Users
EvilGnome |
2019-02-07 ⋅ ThreatStop ⋅ John Bambenek
@online{bambenek:20190207:inside:2a18c89,
author = {John Bambenek},
title = {{An Inside Look at the Infrastructure Behind the Russian APT Gamaredon Group}},
date = {2019-02-07},
organization = {ThreatStop},
url = {https://blog.threatstop.com/russian-apt-gamaredon-group},
language = {English},
urldate = {2020-01-06}
}
An Inside Look at the Infrastructure Behind the Russian APT Gamaredon Group
Pteranodon |
2019-01-07 ⋅ Vitali Kremez
@online{kremez:20190107:lets:07f4941,
author = {Vitali Kremez},
title = {{Let's Learn: Deeper Dive into Gamaredon Group Pteranodon Implant Version '_512'}},
date = {2019-01-07},
url = {https://www.vkremez.com/2019/01/lets-learn-deeper-dive-into-gamaredon.html},
language = {English},
urldate = {2020-01-07}
}
Let's Learn: Deeper Dive into Gamaredon Group Pteranodon Implant Version '_512'
Pteranodon |
2019 ⋅ MITRE ⋅ MITRE ATT&CK
@online{attck:2019:gamaredon:982ecc4,
author = {MITRE ATT&CK},
title = {{Group description: Gamaredon Group}},
date = {2019},
organization = {MITRE},
url = {https://attack.mitre.org/groups/G0047/},
language = {English},
urldate = {2019-12-20}
}
Group description: Gamaredon Group
Gamaredon Group |
2018-11-15 ⋅ Cert-UA ⋅ Cert-UA
@online{certua:20181115:pterodo:3ed19e5,
author = {Cert-UA},
title = {{Виявлена підготовка до проведення кібератаки з використанням ШПЗ типу Pterodo}},
date = {2018-11-15},
organization = {Cert-UA},
url = {https://cert.gov.ua/news/46},
language = {Ukrainian},
urldate = {2020-01-13}
}
Виявлена підготовка до проведення кібератаки з використанням ШПЗ типу Pterodo
Pteranodon |
2018-09-03 ⋅ Cert-UA ⋅ Cert-UA
@online{certua:20180903:bulk:09fa177,
author = {Cert-UA},
title = {{Bulk mailing of spyware like Pterodo}},
date = {2018-09-03},
organization = {Cert-UA},
url = {https://cert.gov.ua/news/42},
language = {Ukrainian},
urldate = {2020-01-08}
}
Bulk mailing of spyware like Pterodo
Pteranodon |
2017-05-31 ⋅ MITRE ⋅ MITRE ATT&CK
@online{attck:20170531:gamaredon:3f7ed54,
author = {MITRE ATT&CK},
title = {{Gamaredon Group}},
date = {2017-05-31},
organization = {MITRE},
url = {https://attack.mitre.org/groups/G0047},
language = {English},
urldate = {2022-08-25}
}
Gamaredon Group
Pteranodon Gamaredon Group |
2017-02-27 ⋅ Palo Alto Networks Unit 42 ⋅ Anthony Kasza, Dominik Reichel
@online{kasza:20170227:gamaredon:da1102c,
author = {Anthony Kasza and Dominik Reichel},
title = {{The Gamaredon Group Toolset Evolution}},
date = {2017-02-27},
organization = {Palo Alto Networks Unit 42},
url = {https://unit42.paloaltonetworks.com/unit-42-title-gamaredon-group-toolset-evolution},
language = {English},
urldate = {2022-08-25}
}
The Gamaredon Group Toolset Evolution
Pteranodon RMS Gamaredon Group |
2017-02-27 ⋅ Palo Alto Networks Unit 42 ⋅ Anthony Kasza, Dominik Reichel
@online{kasza:20170227:gamaredon:322eb5f,
author = {Anthony Kasza and Dominik Reichel},
title = {{The Gamaredon Group Toolset Evolution}},
date = {2017-02-27},
organization = {Palo Alto Networks Unit 42},
url = {https://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution/},
language = {English},
urldate = {2019-12-20}
}
The Gamaredon Group Toolset Evolution
Pteranodon |
2017-02-27 ⋅ Palo Alto Networks Unit 42 ⋅ Anthony Kasza, Dominik Reichel
@online{kasza:20170227:gamaredon:a88c3f8,
author = {Anthony Kasza and Dominik Reichel},
title = {{The Gamaredon Group Toolset Evolution}},
date = {2017-02-27},
organization = {Palo Alto Networks Unit 42},
url = {http://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution},
language = {English},
urldate = {2019-12-20}
}
The Gamaredon Group Toolset Evolution
Gamaredon Group |
2017-02-27 ⋅ Palo Alto Networks Unit 42 ⋅ Anthony Kasza, Dominik Reichel
@online{kasza:20170227:gamaredon:3d28d34,
author = {Anthony Kasza and Dominik Reichel},
title = {{The Gamaredon Group Toolset Evolution}},
date = {2017-02-27},
organization = {Palo Alto Networks Unit 42},
url = {https://unit42.paloaltonetworks.com/unit-42-title-gamaredon-group-toolset-evolution/},
language = {English},
urldate = {2020-01-09}
}
The Gamaredon Group Toolset Evolution
Gamaredon Group |
2016-06-25 ⋅ NSHC ⋅ NSHC Threatrecon Team
@online{team:20160625:sectorc08:84b8f56,
author = {NSHC Threatrecon Team},
title = {{SectorC08: Multi-Layered SFX in Recent Campaigns Target Ukraine}},
date = {2016-06-25},
organization = {NSHC},
url = {https://threatrecon.nshc.net/2019/06/11/sectorc08-multi-layered-sfx-recent-campaigns-target-ukraine/},
language = {English},
urldate = {2020-01-07}
}
SectorC08: Multi-Layered SFX in Recent Campaigns Target Ukraine
Pteranodon |
2015-04-28 ⋅ LookingGlass ⋅ LookingGlass
@techreport{lookingglass:20150428:operation:68a342f,
author = {LookingGlass},
title = {{Operation Armageddon: Cyber Espionage as a Strategic Component of Russian Modern Warfare}},
date = {2015-04-28},
institution = {LookingGlass},
url = {https://www.lookingglasscyber.com/wp-content/uploads/2015/08/Operation_Armageddon_Final.pdf},
language = {English},
urldate = {2020-01-13}
}
Operation Armageddon: Cyber Espionage as a Strategic Component of Russian Modern Warfare
Gamaredon Group |