Gamaredon Group
Also known as: Primitive Bear, Armageddon, Shuckworm, ACTINIUM, Aqua Blizzard
Gamaredon is a high-volume espionage group focused almost entirely on Ukraine. Rather than rare exploits, it relies on a constant stream of phishing documents, remote template injection, simple scripts and rapidly changing infrastructure. It also spreads through USB drives and shared documents inside victim networks.
- Public attribution
- Publicly attributed in November 2021 by the Security Service of Ukraine (SSU) to officers of Russia's Federal Security Service (FSB) posted in Crimea.
- Active since
- Around 2013
- Targets
- Ukrainian government, military and law enforcement
- Ukrainian judiciary and non-governmental organisations
Notable campaigns
2013 onwardSustained targeting of Ukraine
Continuous phishing campaigns against Ukrainian government officials and organisations since around 2013.
2021SSU public attribution
The SSU named five FSB officers as the group's leadership and published a technical report on its tools.
Signature ATT&CK techniques
- T1566.001Phishing: Spearphishing Attachment
- T1221Template Injection
- T1059.005Command and Scripting Interpreter: Visual Basic
- T1091Replication Through Removable Media
- T1080Taint Shared Content
- T1568.001Dynamic Resolution: Fast Flux DNS
Selected from the group's MITRE ATT&CK entry, plus initial-access techniques named in the cited advisories.
Defences that work against this actor
- Block macros and remote template loading in Office documents from the internet.
- Filter attachments and archive types at the mail gateway and sandbox the rest.
- Restrict or disable removable media, and disable autorun.
- Monitor DNS for newly registered and fast-changing domains.