Home / Threat actors / Gamaredon Group

Gamaredon Group G0047

🔔 Create alert

Also known as: IRON TILDEN, Primitive Bear, ACTINIUM, Armageddon, Shuckworm, DEV-0157, Aqua Blizzard, NastyShrew

Updated at source on Oct 1, 2026 · View on MITRE ATT&CK

0

associated CVEs

77

Techniques

6

Malware and tools

Gamaredon Group is a suspected Russian cyber espionage group that has targeted military, law enforcement, judiciary, non-profit, and non-governmental organizations in Ukraine since at least 2013. The name Gamaredon Group derives from a misspelling of the word "Armageddon," found in early campaigns.

In November 2021, the Ukrainian government publicly attributed Gamaredon Group to Russia’s Federal Security Service (FSB) Center 18, an assessment later supported by multiple independent cybersecurity researchers.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

ATT&CK does not cite CVEs for this group.

Techniques by tactic

Resource Development

T1583.001 Domains T1583.003 Virtual Private Server T1583.006 Web Services T1587.003 Digital Certificates T1588.002 Tool T1608.001 Upload Malware

Initial Access

T1091 Replication Through Removable Media T1566.001 Spearphishing Attachment

Execution

T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1059.001 PowerShell T1059.003 Windows Command Shell T1059.005 Visual Basic T1106 Native API T1204.001 Malicious Link T1204.002 Malicious File T1559.001 Component Object Model

Persistence

T1053.005 Scheduled Task T1112 Modify Registry T1137 Office Application Startup T1547.001 Registry Run Keys / Startup Folder

Privilege Escalation

T1053.005 Scheduled Task T1055 Process Injection T1547.001 Registry Run Keys / Startup Folder

Stealth

T1027 Obfuscated Files or Information T1027.004 Compile After Delivery T1027.010 Command Obfuscation T1027.012 LNK Icon Smuggling T1027.015 Compression T1027.016 Junk Code Insertion T1036.005 Match Legitimate Resource Name or Location T1055 Process Injection T1070.004 File Deletion T1140 Deobfuscate/Decode Files or Information T1218.005 Mshta T1218.011 Rundll32 T1221 Template Injection T1480 Execution Guardrails T1497.001 System Checks T1564.003 Hidden Window T1620 Reflective Code Loading

Defense Impairment

T1112 Modify Registry T1685 Disable or Modify Tools

Discovery

T1012 Query Registry T1016.001 Internet Connection Discovery T1033 System Owner/User Discovery T1057 Process Discovery T1082 System Information Discovery T1083 File and Directory Discovery T1120 Peripheral Device Discovery T1497.001 System Checks T1518.001 Security Software Discovery

Lateral Movement

T1021.005 VNC T1080 Taint Shared Content T1091 Replication Through Removable Media T1534 Internal Spearphishing

Collection

T1005 Data from Local System T1025 Data from Removable Media T1039 Data from Network Shared Drive T1113 Screen Capture T1119 Automated Collection

Command and Control

T1001 Data Obfuscation T1071.001 Web Protocols T1090 Proxy T1090.003 Multi-hop Proxy T1095 Non-Application Layer Protocol T1102 Web Service T1102.002 Bidirectional Communication T1102.003 One-Way Communication T1105 Ingress Tool Transfer T1568 Dynamic Resolution T1568.001 Fast Flux DNS T1571 Non-Standard Port

Exfiltration

T1020 Automated Exfiltration T1041 Exfiltration Over C2 Channel

Impact

T1491.001 Internal Defacement T1561.001 Disk Content Wipe

Malware and tools

PowerPunchMalwareS0685
PteranodonMalwareS0147
QuietSieveMalwareS0686
PingToolS0097
RegToolS0075
RemcosToolS0332

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.