- Category
- State · Attributed to a state or working for one.
- Origin
- Russia(high confidence)
- Sponsor
- State-sponsored, FSB Centre 18: Centre for Information Security (TsIB)
- Agency named
- FSB
- Motivation
- Espionage; Information theft and espionage
- Seen
- 2013–2026
- Status
- Active
- ATT&CK
- G0047 · 70 techniques
- Sources
- 16 sources carry it
- Identifier
- GINC-APT-0002 · gamaredon-group
RussiaWhat it is
Gamaredon Group is a suspected Russian cyber espionage group that has targeted military, law enforcement, judiciary, non-profit, and non-governmental organizations in Ukraine since at least 2013. The name Gamaredon Group derives from a misspelling of the word "Armageddon," found in early campaigns.
In November 2021, the Ukrainian government publicly attributed Gamaredon Group to Russia’s Federal Security Service (FSB) Center 18, an assessment later supported by multiple independent cybersecurity researchers.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CERT-UA
- UAC-0010, UAC-0035
- CrowdStrike
- Primitive Bear
- Government agency
- FSB 16th & 18th Centers
- Mandiant
- UNC530
- Microsoft
- Aqua Blizzard, Storm-0593, DEV-0157
- MITRE ATT&CK
- G0047
- NSHC
- SectorC08
- PwC
- Blue Otso
- Qihoo 360
- APT-C-53
- Secureworks
- IRON TILDEN
- Operations
- Operation “STEADY#URSA”
- Other names
- Gamaredon, InvisiMole, ACTINIUM, Armageddon, BlueAlpha, Callisto, Gamaredon - APT-C-53, Hive0051, Hive0051 (IBM), NastyShrew, Shuckworm, Trident Ursa, Winterflounder
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTRussia
- MISP Galaxy (CFR tagging)Russia
- MicrosoftRussia
- ThreatActor.info (Malpedia et al.)Russia · high
Chinese and Russian sources
- Qihoo 360Russia
Targets
- Countries
- Albania, Australia, Austria, Bangladesh, Brazil, Canada, Chile, China, Colombia, Croatia, Denmark, Georgia, Germany, Guatemala, Honduras, India, Indonesia, Iran, Israel, Italy, Japan, Kazakhstan, Latvia, Malaysia, Netherlands, Nigeria, Norway, Pakistan, Papua New Guinea, Poland, Portugal, Romania, Russia, South Africa, South Korea, Spain, Sweden, Türkiye, Ukraine, United Kingdom, United States, Vietnam
- Sectors
- Defense, Government, Law enforcement, NGOs
Tools
The tools and malware families the sources tie to it.
- Archelaus Beta
- DessertDown
- DinoTrain
- InvisiMole
- Ping
- PowerPunch
- Pteranodon
- Pterodo
- QuietSieve
- Reg
- Remcos
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de