Unit 42 threat researchers have recently observed a threat group distributing new, custom developed malware. We have labelled this threat group the Gamaredon Group and our research shows that the Gamaredon Group has been active since at least 2013. In the past, the Gamaredon Group has relied heavily on off-the-shelf tools. Our new research shows the Gamaredon Group have made a shift to custom-developed malware. We believe this shift indicates the Gamaredon Group have improved their technical capabilities.
The same group is tracked under different names by different vendors.
| Vendor | Name |
|---|---|
| OSINT | ACTINIUM |
| OSINT | DEV-0157 |
| OSINT | Blue Otso |
| OSINT | BlueAlpha |
| OSINT | G0047 |
| OSINT | IRON TILDEN |
| OSINT | PRIMITIVE BEAR |
| OSINT | Shuckworm |
| OSINT | Trident Ursa |
| OSINT | UAC-0010 |
| OSINT | Winterflounder |
| OSINT | Aqua Blizzard |
| OSINT | Armageddon |
| OSINT | NastyShrew |
Sectors: Government
Victim countries: Ukraine, Germany
No IOCs extracted yet from reports naming this actor.
Every report in the Global Intel Library that names Gamaredon Group, newest first. Open any report to see the full analysis with provenance.
No reports in the Lore library name this actor yet.
Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to Gamaredon Group. Each row shows why it was linked and where it came from.
No feed indicators linked to this actor yet. Feeds are checked every hour.
Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.