Início / Grupos de ameaça / Gamaredon Group

Gamaredon Group G0047

🔔 Criar alerta

Também conhecido como: IRON TILDEN, Primitive Bear, ACTINIUM, Armageddon, Shuckworm, DEV-0157, Aqua Blizzard, NastyShrew

Atualizado na fonte em 01/10/2026 · Ver no MITRE ATT&CK

0

CVEs associadas

77

Técnicas

6

Malwares e ferramentas

Gamaredon Group is a suspected Russian cyber espionage group that has targeted military, law enforcement, judiciary, non-profit, and non-governmental organizations in Ukraine since at least 2013. The name Gamaredon Group derives from a misspelling of the word "Armageddon," found in early campaigns.

In November 2021, the Ukrainian government publicly attributed Gamaredon Group to Russia’s Federal Security Service (FSB) Center 18, an assessment later supported by multiple independent cybersecurity researchers.

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

O ATT&CK não cita CVEs para este grupo.

Técnicas por tática

Desenvolvimento de recursos

T1583.001 Domains T1583.003 Virtual Private Server T1583.006 Web Services T1587.003 Digital Certificates T1588.002 Tool T1608.001 Upload Malware

Acesso inicial

T1091 Replication Through Removable Media T1566.001 Spearphishing Attachment

Execução

T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1059.001 PowerShell T1059.003 Windows Command Shell T1059.005 Visual Basic T1106 Native API T1204.001 Malicious Link T1204.002 Malicious File T1559.001 Component Object Model

Persistência

T1053.005 Scheduled Task T1112 Modify Registry T1137 Office Application Startup T1547.001 Registry Run Keys / Startup Folder

Escalada de privilégios

T1053.005 Scheduled Task T1055 Process Injection T1547.001 Registry Run Keys / Startup Folder

Furtividade

T1027 Obfuscated Files or Information T1027.004 Compile After Delivery T1027.010 Command Obfuscation T1027.012 LNK Icon Smuggling T1027.015 Compression T1027.016 Junk Code Insertion T1036.005 Match Legitimate Resource Name or Location T1055 Process Injection T1070.004 File Deletion T1140 Deobfuscate/Decode Files or Information T1218.005 Mshta T1218.011 Rundll32 T1221 Template Injection T1480 Execution Guardrails T1497.001 System Checks T1564.003 Hidden Window T1620 Reflective Code Loading

Comprometimento de defesas

T1112 Modify Registry T1685 Disable or Modify Tools

Descoberta

T1012 Query Registry T1016.001 Internet Connection Discovery T1033 System Owner/User Discovery T1057 Process Discovery T1082 System Information Discovery T1083 File and Directory Discovery T1120 Peripheral Device Discovery T1497.001 System Checks T1518.001 Security Software Discovery

Movimento lateral

T1021.005 VNC T1080 Taint Shared Content T1091 Replication Through Removable Media T1534 Internal Spearphishing

Coleta

T1005 Data from Local System T1025 Data from Removable Media T1039 Data from Network Shared Drive T1113 Screen Capture T1119 Automated Collection

Comando e controle

T1001 Data Obfuscation T1071.001 Web Protocols T1090 Proxy T1090.003 Multi-hop Proxy T1095 Non-Application Layer Protocol T1102 Web Service T1102.002 Bidirectional Communication T1102.003 One-Way Communication T1105 Ingress Tool Transfer T1568 Dynamic Resolution T1568.001 Fast Flux DNS T1571 Non-Standard Port

Exfiltração

T1020 Automated Exfiltration T1041 Exfiltration Over C2 Channel

Impacto

T1491.001 Internal Defacement T1561.001 Disk Content Wipe

Malwares e ferramentas

PowerPunchMalwareS0685
PteranodonMalwareS0147
QuietSieveMalwareS0686
PingFerramentaS0097
RegFerramentaS0075
RemcosFerramentaS0332

© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.