State-backedRussia MITRE G0047

Gamaredon Group

Also known as ACTINIUM, DEV-0157, Blue Otso, BlueAlpha, G0047, IRON TILDEN, PRIMITIVE BEAR, Shuckworm, Trident Ursa, UAC-0010, Winterflounder, Aqua Blizzard, Armageddon, NastyShrew

0mentions, 7 days

0mentions, 30 days

nonelast mentioned

Unit 42 threat researchers have recently observed a threat group distributing new, custom developed malware. We have labelled this threat group the Gamaredon Group and our research shows that the Gamaredon Group has been active since at least 2013. In the past, the Gamaredon Group has relied heavily on off-the-shelf tools. Our new research shows the Gamaredon Group have made a shift to custom-developed malware. We believe this shift indicates the Gamaredon Group have improved their technical capabilities.

Targets: Government, Ukraine, Germany

CVEs in recent coverage

No CVEs named alongside this actor in the last 90 days.

Recent victims

No leak-site posts on record for this group.

ATT&CK techniques

T1001 Data Obfuscation T1005 Data from Local System T1012 Query Registry T1016.001 Internet Connection Discovery T1020 Automated Exfiltration T1021.005 VNC T1025 Data from Removable Media T1027 Obfuscated Files or Information T1027.004 Compile After Delivery T1027.010 Command Obfuscation T1027.012 LNK Icon Smuggling T1027.015 Compression T1027.016 Junk Code Insertion T1033 System Owner/User Discovery T1036.005 Match Legitimate Resource Name or Location T1039 Data from Network Shared Drive T1041 Exfiltration Over C2 Channel T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1055 Process Injection T1057 Process Discovery T1059.001 PowerShell T1059.003 Windows Command Shell T1059.005 Visual Basic T1070.004 File Deletion T1071.001 Web Protocols T1080 Taint Shared Content T1082 System Information Discovery T1083 File and Directory Discovery T1090 Proxy T1090.003 Multi-hop Proxy T1091 Replication Through Removable Media T1095 Non-Application Layer Protocol T1102 Web Service T1102.002 Bidirectional Communication T1102.003 One-Way Communication T1105 Ingress Tool Transfer T1106 Native API T1112 Modify Registry T1113 Screen Capture T1119 Automated Collection T1120 Peripheral Device Discovery T1137 Office Application Startup T1140 Deobfuscate/Decode Files or Information T1204.001 Malicious Link T1204.002 Malicious File T1218.005 Mshta T1218.011 Rundll32 T1221 Template Injection T1480 Execution Guardrails T1491.001 Internal Defacement T1497.001 System Checks T1518.001 Security Software Discovery T1534 Internal Spearphishing T1547.001 Registry Run Keys / Startup Folder T1559.001 Component Object Model T1561.001 Disk Content Wipe T1564.003 Hidden Window T1566.001 Spearphishing Attachment T1568 Dynamic Resolution T1568.001 Fast Flux DNS T1571 Non-Standard Port T1583.001 Domains T1583.003 Virtual Private Server T1583.006 Web Services T1587.003 Digital Certificates T1588.002 Tool T1608.001 Upload Malware T1620 Reflective Code Loading T1685 Disable or Modify Tools

Recent activity

No posts or advisories have named this actor recently.

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.