Gamaredon Group is a suspected Russian cyber espionage group that has targeted military, law enforcement, judiciary, non-profit, and non-governmental organizations in Ukraine since at least 2013. The name Gamaredon Group derives from a misspelling of the word "Armageddon," found in early campaigns.12345 In November 2021, the Ukrainian government publicly attributed Gamaredon Group to Russia’s Federal Security Service (FSB) Center 18, an assessment later supported by multiple independent cybersecurity researchers. 67
- Palo Alto Gamaredon Feb 2017
- TrendMicro Gamaredon April 2020
- ESET Gamaredon June 2020
- Symantec Shuckworm January 2022
- Microsoft Actinium February 2022
- Bleepingcomputer Gamardeon FSB November 2021
- Microsoft Actinium February 2022
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| also_known_as | Gamaredon Group | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | IRON TILDEN | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Primitive Bear | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | ACTINIUM | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Armageddon | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Shuckworm | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | DEV-0157 | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Aqua Blizzard | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | NastyShrew | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1491.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1534 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1047 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1095 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1091 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1119 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.016 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.011 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1113 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1518.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1039 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1608.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.015 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1102.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1112 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1620 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1559.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1012 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1025 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1221 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1140 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1080 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1106 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.006 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1561.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1033 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1587.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1564.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.012 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1571 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1020 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1568.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1055 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1120 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1041 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1057 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.010 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1568 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1480 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1102.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1137 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1102 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1497.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1001 | Data Obfuscation | — |
| T1005 | Data from Local System | — |
| T1012 | Query Registry | — |
| T1016.001 | Internet Connection Discovery | — |
| T1020 | Automated Exfiltration | — |
| T1021.005 | VNC | — |
| T1025 | Data from Removable Media | — |
| T1027 | Obfuscated Files or Information | — |
| T1027.004 | Compile After Delivery | — |
| T1027.010 | Command Obfuscation | — |
| T1027.012 | LNK Icon Smuggling | — |
| T1027.015 | Compression | — |
| T1027.016 | Junk Code Insertion | — |
| T1033 | System Owner/User Discovery | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1039 | Data from Network Shared Drive | — |
| T1041 | Exfiltration Over C2 Channel | — |
| T1047 | Windows Management Instrumentation | — |
| T1053.005 | Scheduled Task | — |
| T1055 | Process Injection | — |
| T1057 | Process Discovery | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1059.005 | Visual Basic | — |
| T1070.004 | File Deletion | — |
| T1071.001 | Web Protocols | — |
| T1080 | Taint Shared Content | — |
| T1082 | System Information Discovery | — |
| T1083 | File and Directory Discovery | — |
| T1090 | Proxy | — |
| T1090.003 | Multi-hop Proxy | — |
| T1091 | Replication Through Removable Media | — |
| T1095 | Non-Application Layer Protocol | — |
| T1102 | Web Service | — |
| T1102.002 | Bidirectional Communication | — |
| T1102.003 | One-Way Communication | — |
| T1105 | Ingress Tool Transfer | — |
| T1106 | Native API | — |
| T1112 | Modify Registry | — |
| T1113 | Screen Capture | — |
| T1119 | Automated Collection | — |
| T1120 | Peripheral Device Discovery | — |
| T1137 | Office Application Startup | — |
| T1140 | Deobfuscate/Decode Files or Information | — |
| T1204.001 | Malicious Link | — |
| T1204.002 | Malicious File | — |
| T1218.005 | Mshta | — |
| T1218.011 | Rundll32 | — |
| T1221 | Template Injection | — |
| T1480 | Execution Guardrails | — |
| T1491.001 | Internal Defacement | — |
| T1497.001 | System Checks | — |
| T1518.001 | Security Software Discovery | — |
| T1534 | Internal Spearphishing | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1559.001 | Component Object Model | — |
| T1561.001 | Disk Content Wipe | — |
| T1564.003 | Hidden Window | — |
| T1566.001 | Spearphishing Attachment | — |
| T1568 | Dynamic Resolution | — |
| T1568.001 | Fast Flux DNS | — |
| T1571 | Non-Standard Port | — |
| T1583.001 | Domains | — |
| T1583.003 | Virtual Private Server | — |
| T1583.006 | Web Services | — |
| T1587.003 | Digital Certificates | — |
| T1588.002 | Tool | — |
| T1608.001 | Upload Malware | — |
| T1620 | Reflective Code Loading | — |
| T1685 | Disable or Modify Tools | — |
Aliases
ACTINIUM · Aqua Blizzard · Armageddon · DEV-0157 · Gamaredon Group · IRON TILDEN · NastyShrew · Primitive Bear · Shuckworm
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.