Gamaredon Group
Also tracked as IRON TILDEN, Primitive Bear, ACTINIUM, Armageddon, Shuckworm, DEV-0157, Aqua Blizzard, NastyShrew
Gamaredon Group is a suspected Russian cyber espionage group that has targeted military, law enforcement, judiciary, non-profit, and non-governmental organizations in Ukraine since at least 2013. The name Gamaredon Group derives from a misspelling of the word "Armageddon," found in early campaigns. In November 2021, the Ukrainian government publicly attributed Gamaredon Group to Russia’s Federal Security Service (FSB) Center 18, an assessment later supported by multiple independent cybersecurity researchers.
- Documented techniques
- 70
- Assessed origin
- Russia
- Assessed motivation
- Espionage
- First seen
- 2013
- Basis
- MITRE ATT&CK
How they break in
Techniques MITRE has documented this group using, grouped by the stage of an attack they belong to. This is the actionable half: each one is a behaviour you can look for in your own logs, and a control you can test.
resource development6
initial access1
execution9
discovery8
lateral movement4
collection5
command and control12
defense impairment2
stealth17
- T1027 Obfuscated Files or Information
- T1027.004 Compile After Delivery
- T1027.010 Command Obfuscation
- T1027.012 LNK Icon Smuggling
- T1027.015 Compression
- T1027.016 Junk Code Insertion
- T1036.005 Match Legitimate Resource Name or Location
- T1055 Process Injection
- T1070.004 File Deletion
- T1140 Deobfuscate/Decode Files or Information
- T1218.005 Mshta
- T1218.011 Rundll32
- T1221 Template Injection
- T1480 Execution Guardrails
- T1497.001 System Checks
- T1564.003 Hidden Window
- T1620 Reflective Code Loading
Malware
Families MITRE records this group deploying. Detection names for these are a reasonable place to start.
Tools
Legitimate or dual-use software the group is documented using. Most of it is software your own administrators use too, which is the point.