Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Gallmaker · Unknown · misp-galaxy + mitre-attack · refreshed 2026-10-06

Gallmaker

MITRE G0084 ↗

Gallmaker — ATT&CK roseGA

attack rose · 6 techniques across 4 tactics

Analyst brief

misp-galaxy + mitre-attack

Symantec researchers have uncovered a previously unknown attack group that is targeting government and military targets, including several overseas embassies of an Eastern European country, and military and defense targets in the Middle East. This group eschews custom malware and uses living off the land (LotL) tactics and publicly available hack tools to carry out activities that bear all the hallmarks of a cyber espionage campaign. The group, which we have given the name Gallmaker, has been operating since at least December 2017, with its most recent activity observed in June 2018.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

6 techniques · 4 of 15 tactics

  1. Initial access

    1 technique

  2. Execution

    3 techniques

  3. Stealth

    1 technique

  4. Collection

    1 technique

select a technique

Take it with you

keyless · no signup

References

2 sources
  1. 1.symantec.com/blogs/threat-intelligence/gallmaker-attack-group
  2. 2.attack.mitre.org/groups/G0084

Track Gallmaker on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.