# Gamaredon Group: threat group profile

> Gamaredon Group is a threat group. Public reporting links it to 45 attack techniques, and to attacks on government organisations, with 2 countries and victims named. This free profile shows how it works and who it targets, so you can judge the risk to you.

Canonical page: https://www.precursorintelligence.com/threat-actors/gamaredon-group
Breadcrumb: [Home](https://www.precursorintelligence.com/) > [Threat groups](https://www.precursorintelligence.com/threat-actors) > Gamaredon Group

## At a glance

| Fact | Value |
|---|---|
| Attack techniques | 45 (plus 28 sub-techniques) |
| Countries and victims named | 2 |
| Thought to operate from | Not known |
| Other names | 13 |
| Public reports | 21 |

## Who is Gamaredon Group?

Gamaredon Group is a threat group. Public reporting links it to 45 attack techniques, and to attacks on government organisations, with 2 countries and victims named.

### Also known as

ACTINIUM, DEV-0157, Blue Otso, BlueAlpha, G0047, IRON TILDEN, PRIMITIVE BEAR, Shuckworm, Trident Ursa, UAC-0010, Winterflounder, Aqua Blizzard, Actinium

Security companies each give the same group their own name, so one group can have many.

### What public reporting says

> Unit 42 threat researchers have recently observed a threat group distributing new, custom developed malware. We have labelled this threat group the Gamaredon Group and our research shows that the Gamaredon Group has been active since at least 2013.  In the past, the Gamaredon Group has relied heavily on off-the-shelf tools. Our new research shows the Gamaredon Group have made a shift to custom-developed malware. We believe this shift indicates the Gamaredon Group have improved their technical capabilities.

## How does Gamaredon Group attack? Stage by stage

Each technique is a known way attackers research, get in, stay hidden or do damage. Here are the 45 linked to Gamaredon Group. Some techniques belong to more than one stage. Public reporting also lists 28 more specific variations of them, called sub-techniques.

### 1. Research (0)

- None linked in public reporting.

### 2. Preparation (3)

- T1583: Acquire Infrastructure
- T1588: Obtain Capabilities
- T1608: Stage Capabilities

### 3. Getting in (1)

- T1566: Phishing

### 4. Running code (6)

- T1047: Windows Management Instrumentation
- T1053: Scheduled Task/Job
- T1059: Command and Scripting Interpreter
- T1106: Native API
- T1204: User Execution
- T1559: Inter-Process Communication

### 5. Staying in (4)

- T1053: Scheduled Task/Job
- T1112: Modify Registry
- T1137: Office Application Startup
- T1547: Boot or Logon Autostart Execution

### 6. Taking control (2)

- T1053: Scheduled Task/Job
- T1547: Boot or Logon Autostart Execution

### 7. Hiding (8)

- T1027: Obfuscated Files or Information
- T1036: Masquerading
- T1070: Indicator Removal
- T1140: Deobfuscate/Decode Files or Information
- T1218: System Binary Proxy Execution
- T1221: Template Injection
- T1480: Execution Guardrails
- T1564: Hide Artifacts

### 8. Disabling defences (2)

- T1112: Modify Registry
- T1685: Disable or Modify Tools

### 9. Stealing passwords (0)

- None linked in public reporting.

### 10. Looking around (6)

- T1016: System Network Configuration Discovery
- T1033: System Owner/User Discovery
- T1057: Process Discovery
- T1082: System Information Discovery
- T1083: File and Directory Discovery
- T1120: Peripheral Device Discovery

### 11. Spreading (3)

- T1021: Remote Services
- T1080: Taint Shared Content
- T1534: Internal Spearphishing

### 12. Gathering data (5)

- T1005: Data from Local System
- T1025: Data from Removable Media
- T1039: Data from Network Shared Drive
- T1113: Screen Capture
- T1119: Automated Collection

### 13. Keeping contact (5)

- T1001: Data Obfuscation
- T1071: Application Layer Protocol
- T1102: Web Service
- T1105: Ingress Tool Transfer
- T1568: Dynamic Resolution

### 14. Taking data out (2)

- T1020: Automated Exfiltration
- T1041: Exfiltration Over C2 Channel

### 15. Causing damage (2)

- T1491: Defacement
- T1561: Disk Wipe

## Who does Gamaredon Group go after?

**Sectors:** Government

**Countries and victims named:** Ukraine, Germany

See threats by industry: https://www.precursorintelligence.com/industries

## Public reports about Gamaredon Group

- http://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution
- https://www.lookingglasscyber.com/wp-content/uploads/2015/08/Operation_Armageddon_Final.pdf
- https://unit42.paloaltonetworks.com/unit-42-title-gamaredon-group-toolset-evolution
- https://attack.mitre.org/groups/G0047
- https://github.com/StrangerealIntel/CyberThreatIntel/tree/master/Russia/APT/Gamaredon
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf
- https://www.welivesecurity.com/2020/06/18/digging-up-invisimole-hidden-arsenal
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine
- https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations
- https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game
- https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021
- https://go.recordedfuture.com/hubfs/reports/cta-2019-1212.pdf
- https://unit42.paloaltonetworks.com/atoms/tridentursa
- https://cert.gov.ua/article/1229152
- https://cert.gov.ua/article/971405
- https://cert.gov.ua/article/40240
- https://cert.gov.ua/article/39386
- https://cert.gov.ua/article/39086
- https://cert.gov.ua/article/39138
- https://cert.gov.ua/article/18365
- https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Cyber-Sicherheitslage/Analysen-und-Prognosen/Threat-Intelligence/Aktive_APT-Gruppen/aktive-apt-gruppen_node.html

## Frequently asked questions

### Who is Gamaredon Group?

Gamaredon Group is a threat group. Public reporting links it to 45 attack techniques, and to attacks on government organisations, with 2 countries and victims named.

### Who does Gamaredon Group target?

In public reporting, sectors named include government, and 2 countries and victims are named, including Ukraine and Germany.

### How does Gamaredon Group attack?

Public reporting links Gamaredon Group to 45 attack techniques. Most of them are about hiding, running code and looking around.

### How do I know if Gamaredon Group is a risk to my business?

Create an account and tell us the software you run. We match it against known flaws, including those linked to threat groups, rank each one from 0 to 100 and tell you as soon as we spot something that affects you.

## Check whether it matters to your business

A free Precursor Intelligence account (no card needed) matches the software you run against known flaws, including those linked to threat groups, ranks each one from 0 to 100 and tells you as soon as we spot something that affects you. It also shows which threat groups and ransomware gangs are hitting your sector, with profiles of over 900 groups and a PDF dossier for each.

- Start free: https://www.precursorintelligence.com/register
- Book a demo: https://www.precursorintelligence.com/contact