Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · GCMAN · Unknown · assessed origin Russia · misp-galaxy + mitre-attack · refreshed 2026-10-06

GCMAN

  • G0036

MITRE G0036 ↗

GCMAN — ATT&CK roseGC

attack rose · 2 techniques across 1 tactics

Analyst brief

misp-galaxy + mitre-attack

GCMAN is a threat group that focuses on targeting banks for the purpose of transferring money to e-currency services.

Observed targets (as stated by the sources)

0 countries · 1 sectors
Assessed origin: Russia

assessed origin · Russiaobserved targets · 0

sectors · 1

  • Bank

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

2 techniques · 1 of 15 tactics

  1. Lateral movement

    2 techniques

select a technique

Take it with you

keyless · no signup

References

3 sources
  1. 1.securelist.com/apt-style-bank-robberies-increase-with-metel-gcman-and…
  2. 2.attack.mitre.org/groups/G0036
  3. 3.attack.mitre.org/groups/G0036

Track GCMAN on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.