Skip to content

Gamaredon Group

Gamaredon Group is a suspected Russian cyber espionage group that has targeted military, law enforcement, judiciary, non-profit, and non-governmental organizations in Ukraine since at least 2013. The name Gamaredon Group derives from a misspelling of the word "Armageddon," found in early campaigns. In November 2021, the Ukrainian government publicly attributed Gamaredon Group to Russia’s Federal Security Service (FSB) Center 18, an assessment later supported by multiple independent cybersecurity researchers.

ATT&CK ID: G0047
Origin: Russia
Weather family: Blizzard
Techniques: 55
Tools: 6

Also tracked as IRON TILDEN · Primitive Bear · ACTINIUM · Armageddon · Shuckworm · DEV-0157 · Aqua Blizzard · NastyShrew

Techniques

Resource Development

Acquire Infrastructure Develop Capabilities Obtain Capabilities Stage Capabilities

Initial Access

Replication Through Removable Media Phishing

Execution

Windows Management Instrumentation Scheduled Task/Job Command and Scripting Interpreter Native API User Execution Inter-Process Communication

Persistence

Scheduled Task/Job Modify Registry Office Application Startup Boot or Logon Autostart Execution

Privilege Escalation

Scheduled Task/Job Process Injection Boot or Logon Autostart Execution

Stealth

Obfuscated Files or Information Masquerading Process Injection Indicator Removal Deobfuscate/Decode Files or Information System Binary Proxy Execution Template Injection Execution Guardrails Virtualization/Sandbox Evasion Hide Artifacts Reflective Code Loading

Defense Impairment

Modify Registry Disable or Modify Tools

Discovery

Query Registry System Network Configuration Discovery System Owner/User Discovery Process Discovery System Information Discovery File and Directory Discovery Peripheral Device Discovery Virtualization/Sandbox Evasion Software Discovery

Lateral Movement

Remote Services Taint Shared Content Replication Through Removable Media Internal Spearphishing

Collection

Data from Local System Data from Removable Media Data from Network Shared Drive Screen Capture Automated Collection

Command and Control

Data Obfuscation Application Layer Protocol Proxy Non-Application Layer Protocol Web Service Ingress Tool Transfer Dynamic Resolution Non-Standard Port

Exfiltration

Automated Exfiltration Exfiltration Over C2 Channel

Impact

Defacement Disk Wipe

Software

Ping · PowerPunch · Pteranodon · QuietSieve · Reg · Remcos

MITRE ATT&CK All threat actors