Gamaredon Group - G0047

Created: 2017-05-31T21:32:09.849Z

Modified: 2023-03-22T04:29:39.915Z

Contributors: ESET,Trend Micro Incorporated

Aliases

Gamaredon Group,IRON TILDEN,Primitive Bear,ACTINIUM,Armageddon,Shuckworm,DEV-0157

Description

Gamaredon Group is a suspected Russian cyber espionage threat group that has targeted military, NGO, judiciary, law enforcement, and non-profit organizations in Ukraine since at least 2013. The name Gamaredon Group comes from a misspelling of the word "Armageddon", which was detected in the adversary's early campaigns.(Citation: Palo Alto Gamaredon Feb 2017)(Citation: TrendMicro Gamaredon April 2020)(Citation: ESET Gamaredon June 2020)(Citation: Symantec Shuckworm January 2022)(Citation: Microsoft Actinium February 2022)

In November 2021, the Ukrainian government publicly attributed Gamaredon Group to Russia's Federal Security Service (FSB) Center 18.(Citation: Bleepingcomputer Gamardeon FSB November 2021)(Citation: Microsoft Actinium February 2022)

Techniques Used

Gamaredon Group has used obfuscated or encrypted scripts.(Citation: ESET Gamaredon June 2020)(Citation: Microsoft Actinium February 2022)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1016.001|Internet Connection Discovery|

Gamaredon Group has tested connectivity between a compromised machine and a C2 server using

Ping with commands such as

Gamaredon Group has used

Gamaredon Group has used legitimate process names to hide malware including

Gamaredon Group has used

Gamaredon Group has incorporated dynamic DNS domains in its infrastructure.(Citation: Unit 42 Gamaredon February 2022)|
|mitre-attack|enterprise-attack|PRE|T1608.001|Upload Malware|