Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Gamaredon Group · Unknown · assessed origin Russia · misp-galaxy + mitre-attack · refreshed 2026-10-06

Gamaredon Group

  • ACTINIUM
  • DEV-0157
  • Blue Otso
  • BlueAlpha
  • G0047
  • IRON TILDEN
  • PRIMITIVE BEAR
  • Shuckworm

MITRE G0047 ↗

Gamaredon Group — ATT&CK roseGG

attack rose · 70 techniques across 12 tactics

Analyst brief

misp-galaxy + mitre-attack

Unit 42 threat researchers have recently observed a threat group distributing new, custom developed malware. We have labelled this threat group the Gamaredon Group and our research shows that the Gamaredon Group has been active since at least 2013. In the past, the Gamaredon Group has relied heavily on off-the-shelf tools.

Our new research shows the Gamaredon Group have made a shift to custom-developed malware. We believe this shift indicates the Gamaredon Group have improved their technical capabilities.

Observed targets (as stated by the sources)

2 countries · 1 sectors
UkraineGermanyAssessed origin: Russia

assessed origin · Russiaobserved targets · 2

countries · 2

  • Ukraine
  • Germany

sectors · 1

  • Government

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

70 techniques · 12 of 15 tactics

  1. Resource development

    6 techniques

  2. Initial access

    1 technique

  3. Execution

    9 techniques

  4. Persistence

    2 techniques

  5. Stealth

    17 techniques

  6. Defense impairment

    2 techniques

  7. Discovery

    8 techniques

  8. Lateral movement

    4 techniques

  9. Collection

    5 techniques

  10. Command and control

    12 techniques

  11. Exfiltration

    2 techniques

  12. Impact

    2 techniques

select a technique

Arsenal

3 malware · 3 tools
Malware
Malware · 3ATT&CK
QuietSieveS0686 ↗
PteranodonS0147 ↗
PowerPunchS0685 ↗
Tools
Tools · 3ATT&CK
RemcosS0332 ↗
PingS0097 ↗
RegS0075 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2022Shuckworm Continues Cyber-Espionage Attacks Against UkraineSymantec ↗
  2. 2022Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukrainepalo alto networks ↗
  3. 2022ACTINIUM targets Ukrainian organizationsmicrosoft ↗
  4. 2022Shuckworm: Espionage Group Continues Intense Campaign Against UkraineSymantec ↗
  5. 2022Russia's Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of UkrainePalo Alto ↗
  6. 2017The Gamaredon Group Toolset EvolutionPalo Alto Networks ↗

Take it with you

keyless · no signup

References

27 sources
  1. 1.researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution
  2. 2.lookingglasscyber.com/wp-content/uploads/2015/08/Operation_Armageddon_Final.…
  3. 3.unit42.paloaltonetworks.com/unit-42-title-gamaredon-group-toolset-evolution
  4. 4.attack.mitre.org/groups/G0047
  5. 5.github.com/StrangerealIntel/CyberThreatIntel/tree/master/Russia/A…
  6. 6.go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThrea…
  7. 7.welivesecurity.com/2020/06/18/digging-up-invisimole-hidden-arsenal
  8. 8.symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionag…
  9. 9.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-or…
  10. 10.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game
  11. +17 more in the JSON record

Track Gamaredon Group on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.