Gallmaker is a cyberespionage group that has targeted victims in the Middle East and has been active since at least December 2017. The group has mainly targeted victims in the defense, military, and government sectors.1
- Symantec Gallmaker Oct 2018
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| uses_technique | tech_t1204.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1559.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1027 | Obfuscated Files or Information | — |
| T1059.001 | PowerShell | — |
| T1204.002 | Malicious File | — |
| T1559.002 | Dynamic Data Exchange | — |
| T1560.001 | Archive via Utility | — |
| T1566.001 | Spearphishing Attachment | — |
Aliases
Gallmaker
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.