- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Russia(high confidence)
- Motivation
- Financial crime; Financial gain
- Seen
- 2020
- Sources
- 6 sources carry it
- Identifier
- GINC-APT-0320 · oldgremlin
What it is
OldGremlin is a Russian-speaking ransomware group that has been active for several years. They primarily target organizations in Russia, including banks, logistics, industrial, insurance, retail, and IT companies. OldGremlin is known for using phishing emails as an initial infection vector and has developed custom malware for both Windows and Linux systems. They have conducted multiple malicious email campaigns and demand large ransoms from their victims, with some reaching millions of dollars.
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Targets
- Countries
- Russia
- Sectors
- Financial, Healthcare, Media
Tools
The tools and malware families the sources tie to it.
- Cobalt Strike
- TinyCryptor
- TinyNode
- TinyPosh
- Windows Remote Desktop
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de