Gamaredon Group
Threat actorAttributed to Russia by MITRE ATT&CK (source). An attribution, not a proven fact.
Names and who uses them
- Gamaredon GroupOur name
- ACTINIUMMicrosoft
- Aqua BlizzardMicrosoft
- DEV-0157Microsoft
- NastyShrewMITRE ATT&CK
- Primitive BearPalo Alto Networks
- IRON TILDENSecureworks
- ArmageddonSymantec
- ShuckwormSymantec
Targets
Sectors: Government, Defence, NGOs and think tanks
Regions: Ukraine
Source: MITRE ATT&CKKnown techniques
- T1001Data Obfuscation
- T1005Data from Local System
- T1012Query Registry
- T1016.001Internet Connection Discovery
- T1020Automated Exfiltration
- T1021.005VNC
- T1025Data from Removable Media
- T1027Obfuscated Files or Information
- T1027.004Compile After Delivery
- T1027.010Command Obfuscation
- T1027.012LNK Icon Smuggling
- T1027.015Compression
- T1027.016Junk Code Insertion
- T1033System Owner/User Discovery
- T1036.005Match Legitimate Resource Name or Location
- T1039Data from Network Shared Drive
- T1041Exfiltration Over C2 Channel
- T1047Windows Management Instrumentation
- T1053.005Scheduled Task
- T1055Process Injection
- T1057Process Discovery
- T1059.001PowerShell
- T1059.003Windows Command Shell
- T1059.005Visual Basic
- T1070.004File Deletion
- T1071.001Web Protocols
- T1080Taint Shared Content
- T1082System Information Discovery
- T1083File and Directory Discovery
- T1090Proxy
- T1090.003Multi-hop Proxy
- T1091Replication Through Removable Media
- T1095Non-Application Layer Protocol
- T1102Web Service
- T1102.002Bidirectional Communication
- T1102.003One-Way Communication
- T1105Ingress Tool Transfer
- T1106Native API
- T1112Modify Registry
- T1113Screen Capture
Malware and tools used
Source: MITRE ATT&CKRecent news
No stories yet.