Gamaredon
≈ 1 min read
Names in other languages
No names in other languages are held for this entry yet.
Article bodies are English and are not machine-translated. A name in another language is not a translation of the article.
Gamaredon, also known as Primitive Bear, UNC530, ACTINIUM, or Aqua Blizzard (by Microsoft) is a Russian advanced persistent threat that has been active since at least 2013.
Gamaredon, also known as Primitive Bear, UNC530, ACTINIUM, or Aqua Blizzard (by Microsoft) is a Russian advanced persistent threat that has been active since at least 2013. ==Motivation== Cyber espionage appears to be the main goal of the group,; unlike most APTs, Gamaredon broadly targets all users all over the globe (in addition to also focusing on certain victims, especially Ukrainian organizations ) and appears to provide services for other APTs. For example, the InvisiMole threat group has attacked select systems that Gamaredon had earlier compromised and fingerprinted. ==Tactics== The group frequently uses spear phishing techniques with malicious code attachments that download remote templates containing malware. Malware used by the group includes Pterodo, PowerPunch, ObfuMerry, ObfuBerry, DilongTrash, DinoTrain, and DesertDown. ==Ukraine== On 19 January 2022, they attempted to compromise a Western government entity in Ukraine. ==See also== Cyberwarfare by Russia Russo-Ukrainian cyberwarfare ==References==
Text derived from https://en.wikipedia.org/w/index.php?oldid=1345628511 under CC BY-SA 4.0; modifications have been made.