GCMAN
G0036
GCMAN is a threat group that focuses on targeting banks for the purpose of transferring money to e-currency services.
origin (suspected)
Russiaattribution confidence: medium (50)
target sectors
Bank
GCMAN· Russia
GCMAN is a threat group targeting the banking sector to transfer funds to e-currency services.
Analyst brief
GCMAN is a threat group that focuses on targeting banks to transfer money to e-currency services. They specifically target the banking sector. The group uses SSH (T1021.004) and VNC (T1021.005) for lateral movement. Defenders should monitor unusual activity over these protocols, especially suspicious transactions related to money transfers, and pay attention to traffic heading to e-currency platforms.
unknown
Kill-chain playbook1
Monitor SSH and VNC connections and restrict access to sensitive servers.
FAQ2
Which protocols does the GCMAN group use for lateral movement within a network?
The GCMAN group uses SSH (T1021.004) and VNC (T1021.005) for lateral movement.
What sector does the GCMAN group primarily target?
The GCMAN group specifically targets the banking sector.
See also6
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.