Gamaredon GroupThreat actor
- actinium
- aqua blizzard
- blue otso
- bluealpha
- dev-0157
- g0047
- iron tilden
- nastyshrew
- Primitive Bear
- shuckworm
- trident ursa
- UAC-0010
- winterflounder
Unit 42 threat researchers have recently observed a threat group distributing new, custom developed malware. We have labelled this threat group the Gamaredon Group and our research shows that the Gamaredon Group has been active since at least 2013. In the past, the Gamaredon Group has relied heavily on off-the-shelf tools.From MISP Galaxy
Last reported 4 months ago, by Sekoia.io6 reports
ATT&CK techniques
6 of 27 · each with the sentence it comes from- T1566.001Spearphishing Attachment
“Spearphishing attachments that utilize template injection may bypass security controls because they contain no embedded VBA code.”
- T1036Masquerading
“To maintain a resilient connection with C2 server, GammaWorm establishes a persistence mechanism masquerading as a system maintenance tool.”
- T1053.005Scheduled Task
“It then establishes persistence by creating a scheduled task to execute this ADS before terminating.”
- T1221Template Injection
“Over the past four months, these techniques have consisted of spearphishing, remote document template injection, startup folder persistence, VBA/VBScript languages, and Dynamic DNS command & control infrastructure.”
- T1547.001Registry Run Keys / Startup Folder
“T1060 - Registry Run Keys / Startup Folder”
- T1005Data from Local System
“T1005”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
6 reports, newest first · the exact sentence from each-
FSB’s matryoshka #3/3: Gamaredon's Gammasteel Infostealer“The Sekoia.io Threat Detection & Research (TDR) team continuously monitors Gamaredon (aka UAC-0010, Armagedon), an FSB operated Russian intrusion-set historically targeting Ukrainian governmental and critical infrastructure.”
-
FSB’s matryoshka #2/3: Gamaredon's Gammaload Malware“The Sekoia.io Threat Detection & Research (TDR) team continuously monitors Gamaredon (aka UAC-0010, Armagedon), an FSB operated Russian intrusion-set historically targeting Ukrainian governmental and critical infrastructure.”
-
FSB’s matryoshka #1/3: Inside Gamaredon Cyber Operations“This long-term campaign is attributed to Gamaredon (aka ACTINUM, Armageddon, UAC-0010, BlueAlpha), a Russian state-sponsored intrusion-set officially linked by national agencies, such as the Security Service of Ukraine (SSU), to the Russian Federal Security Service (FSB).”
-
Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open“Earth Dahu is our designation for the threat actor commonly known as Gamaredon (also tracked as Primitive Bear, Shuckworm, Aqua Blizzard, UAC-0010, BlueAlpha, and ACTINIUM).”
-
A close look at the advanced techniques used in a Malaysian-focused APT campaign“This technique is known as template injection, which you may recall from our Playing defense against Gamaredon Group blog post.”
-
Playing defense against Gamaredon Group“Playing defense against Gamaredon Group”
Indicators in its reports
named in the reports above- mil.gov[.]uain 2 reports
- lesma[.]euin 2 reports
- check-host[.]netin 2 reports
- hxxps://bold.zsjtn41091.workers[.]devin 2 reports
- bold.zsjtn41091.workers[.]devin 2 reports
- 3d371ef71e40c34a…b63cd4acda25in 1 report
- 166.0.132[.]237in 1 report
- 136.0.141[.]41in 1 report
- 136.0.141[.]138in 1 report
- 38.225.209[.]229in 1 report
- 136.0.141[.]112in 1 report
- 38.225.209[.]122in 1 report
- 23.26.237[.]80in 1 report
- hxxps://[email redacted][.]dev/pathin 1 report
- malicious.workers[.]devin 1 report
Copy these 15 indicators · defanged
Thanks — we review every report.