Gamaredon Group
- ID
- G0047
- Associated names
- IRON TILDEN, Primitive Bear, ACTINIUM, Armageddon, Shuckworm, DEV-0157, Aqua Blizzard, NastyShrew
- Source
- attack.mitre.org
- MITRE last modified
- 2 Oct 2026
Gamaredon Group is a suspected Russian cyber espionage group that has targeted military, law enforcement, judiciary, non-profit, and non-governmental organizations in Ukraine since at least 2013. The name Gamaredon Group derives from a misspelling of the word "Armageddon," found in early campaigns.[1][2][3][4][5]
In November 2021, the Ukrainian government publicly attributed Gamaredon Group to Russia’s Federal Security Service (FSB) Center 18, an assessment later supported by multiple independent cybersecurity researchers. [6][5]
Techniques used (70)
- T1001 Data Obfuscation
- T1005 Data from Local System
- T1012 Query Registry
- T1016.001 Internet Connection Discovery
- T1020 Automated Exfiltration
- T1021.005 VNC
- T1025 Data from Removable Media
- T1027 Obfuscated Files or Information
- T1027.004 Compile After Delivery
- T1027.010 Command Obfuscation
- T1027.012 LNK Icon Smuggling
- T1027.015 Compression
- T1027.016 Junk Code Insertion
- T1033 System Owner/User Discovery
- T1036.005 Match Legitimate Resource Name or Location
- T1039 Data from Network Shared Drive
- T1041 Exfiltration Over C2 Channel
- T1047 Windows Management Instrumentation
- T1053.005 Scheduled Task
- T1055 Process Injection
- T1057 Process Discovery
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.005 Visual Basic
- T1070.004 File Deletion
- T1071.001 Web Protocols
- T1080 Taint Shared Content
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1090 Proxy
- T1090.003 Multi-hop Proxy
- T1091 Replication Through Removable Media
- T1095 Non-Application Layer Protocol
- T1102 Web Service
- T1102.002 Bidirectional Communication
- T1102.003 One-Way Communication
- T1105 Ingress Tool Transfer
- T1106 Native API
- T1112 Modify Registry
- T1113 Screen Capture
- T1119 Automated Collection
- T1120 Peripheral Device Discovery
- T1137 Office Application Startup
- T1140 Deobfuscate/Decode Files or Information
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1218.005 Mshta
- T1218.011 Rundll32
- T1221 Template Injection
- T1480 Execution Guardrails
- T1491.001 Internal Defacement
- T1497.001 System Checks
- T1518.001 Security Software Discovery
- T1534 Internal Spearphishing
- T1547.001 Registry Run Keys / Startup Folder
- T1559.001 Component Object Model
- T1561.001 Disk Content Wipe
- T1564.003 Hidden Window
- T1566.001 Spearphishing Attachment
- T1568 Dynamic Resolution
- T1568.001 Fast Flux DNS
- T1571 Non-Standard Port
- T1583.001 Domains
- T1583.003 Virtual Private Server
- T1583.006 Web Services
- T1587.003 Digital Certificates
- T1588.002 Tool
- T1608.001 Upload Malware
- T1620 Reflective Code Loading
- T1685 Disable or Modify Tools