AndromedaMalware
- b106-gamarue
- b67-ss-gamarue
- Gamarue
ANDROMEDA is commodity malware that was widespread in the early 2010's and continues to be observed in infections across a wide variety of industries. During the 2022 C0026 campaign, threat actors re-registered expired ANDROMEDA C2 domains to spread malware to select targets in Ukraine.From MITRE ATT&CK
Last reported 2 days ago, by The Hacker News3 reports
ATT&CK techniques
6 techniques · each with the sentence it comes from- T1684Social Engineering
“…e regular personnel trainings, which should include not only training sessions on issues related to targeted attacks, phishing and social engineering, but also “combat training”: banks should simulate targeted attacks or phishing emails from time to time.”
- T1036Masquerading
“In July 2026 we most frequently observed it masquerading as PDF readers.”
- T1056.001Keylogging
“Remote access trojan with several capabilities including keylogging, screen capturing, and remote shell access”
- T1110Brute Force
“…oducts (CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766) or, alternatively, credential exposure and brute-force password attacks, for initial access, followed by persistence, privilege escalation, lateral movement, data exfiltration, and ransomwa…”
- T1204.004Malicious Copy and Paste
“…ites to deliver malware via drive-by download techniques, often using fake CAPTCHA lures to trick users into executing code via malicious copy and paste (aka paste and run, ClickFix, fakeCAPTCHA).”
- T1556.009Conditional Access Policies
“Restricting or blocking the device code authentication flow through Conditional Access policies for users and locations that do not require it”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More“Andromeda Confirms Credential Theft Affecting AI Infrastructure Customers”
-
Intelligence Insights: August 2026“Gamarue”
-
Targeted attacks on banks“…nly two known hacker groups, Anunak and Corkow, which conducted targeted attacks, whereas in 2015 there were three (Anunak, Corkow and Andromeda), and in 2016 four of them (Buhtrap, Lurk, Cobalt and MoneyTaker).”
Indicators in its reports
named in the reports above- gl1nto.spiintforge[.]ruin 1 report
- reeemso.forwardbox.co[.]ukin 1 report
- chainlist[.]orgin 1 report
- 119.13.79[.]145in 1 report
- 210.242.76[.]32in 1 report
- 211.20.144[.]116in 1 report
- blueskyweb[.]xyzin 1 report
- riskified-okta[.]comin 1 report
- shipmonk-servicenow[.]comin 1 report
Copy these 9 indicators · defanged
Thanks — we review every report.