- Category
- Targeted, sponsor unknown · Targeted intrusions with no sponsor attributed.
- Origin
- Unknown
- Motivation
- Information theft and espionage
- Seen
- 2017–2026
- Status
- Active
- ATT&CK
- G0084 · 6 techniques
- Sources
- 10 sources carry it
- Identifier
- GINC-APT-0065 · gallmaker
What it is
Gallmaker is a cyberespionage group that has targeted victims in the Middle East and has been active since at least December 2017. The group has mainly targeted victims in the defense, military, and government sectors.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- MITRE ATT&CK
- G0084
Targets
- Sectors
- Defense, Embassies, Government
Tools
The tools and malware families the sources tie to it.
- Archelaus Beta
- Cyber Eye RAT
- CyberGate
- Living off the Land
- Unknown Logger
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de