Gamaredon Group
BedrohungsakteurRUauch bekannt als
Weitere Namen und Kennungen dieser Entität.
ATT&CK
ACTINIUM · Aqua Blizzard · Armageddon · DEV-0157 · Gamaredon Group · IRON TILDEN · NastyShrew · Primitive Bear · Shuckworm
MISP
ACTINIUM · Aqua Blizzard · Blue Otso · BlueAlpha · DEV-0157 · Gamaredon Group · IRON TILDEN · PRIMITIVE BEAR · Shuckworm · Trident Ursa · UAC-0010 · Winterflounder
Unit 42 threat researchers have recently observed a threat group distributing new, custom developed malware. We have labelled this threat group the Gamaredon Group and our research shows that the Gamaredon Group has been active since at least 2013. In the past, the Gamaredon Group has relied heavily on off-the-shelf tools. Our new research shows the Gamaredon Group have made a shift to custom-developed malware. We believe this shift indicates the Gamaredon Group have improved their technical capabilities.
zugeordnete ATT&CK-Gruppen
Zugehörige Bedrohungsgruppen.
genutzte Techniken (70)
ATT&CK-Techniken, die dies ermöglicht oder abbildet.
genutzte Software (6)
Zugehörige Malware und Tools.
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution
- https://www.lookingglasscyber.com/wp-content/uploads/2015/08/Operation_Armageddon_Final.pdf
- https://unit42.paloaltonetworks.com/unit-42-title-gamaredon-group-toolset-evolution
- https://attack.mitre.org/groups/G0047
- https://github.com/StrangerealIntel/CyberThreatIntel/tree/master/Russia/APT/Gamaredon
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf
- https://www.welivesecurity.com/2020/06/18/digging-up-invisimole-hidden-arsenal
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine