GINC-APT-0320 · Criminal

OldGremlin

Category
Criminal · Financially motivated: ransomware, fraud and theft.
Origin
Russia(high confidence)
Motivation
Financial crime; Financial gain
Seen
2020
Sources
6 sources carry it
Identifier
GINC-APT-0320 · oldgremlin

What it is

OldGremlin is a Russian-speaking ransomware group that has been active for several years. They primarily target organizations in Russia, including banks, logistics, industrial, insurance, retail, and IT companies. OldGremlin is known for using phishing emails as an initial infection vector and has developed custom malware for both Windows and Linux systems. They have conducted multiple malicious email campaigns and demand large ransoms from their victims, with some reaching millions of dollars.

Attribution

Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.

Targets

Countries
Russia
Sectors
Financial, Healthcare, Media

Tools

The tools and malware families the sources tie to it.

  • Cobalt Strike
  • TinyCryptor
  • TinyNode
  • TinyPosh
  • Windows Remote Desktop

Sources