Actors/Nation-state / APT/Europe

Gamaredon Group

G0047APTRU · Russia

AKA BlueAlpha · ACTINIUM · UAC-0010 · WINTERFLOUNDER · Shuckworm · Trident Ursa · DEV-0157 · Armageddon

CrowdStrike: PRIMITIVE BEARESET: GamaredonMandiant: UNC530Microsoft: Aqua BlizzardMITRE: G0047Secureworks: IRON TILDEN

FSB-attributed cyber group operating against Ukraine since 2013.

Targets5

Sectors4

Threat types1

GIRs covered0/480

Active since2013

Also tracked as

6 vendor names · 8 other aliases

Open Rosetta Stone

CrowdStrike

PRIMITIVE BEAR

ESET

Gamaredon

Mandiant

UNC530

Microsoft

Aqua Blizzard

MITRE

G0047

Secureworks

IRON TILDEN

UNATTRIBUTED ALIASESBlueAlphaACTINIUMUAC-0010WINTERFLOUNDERShuckwormTrident UrsaDEV-0157Armageddon

Victimology

Geographic footprint · 5 countries

origin · Russiatargeted countries · 5

EUROPE · 5

Lithuania · Latvia · Moldova · Poland · Ukraine

Sectors targeted

4 of 40

Government100 actors Defense72 actors Education & Research62 actors Legal & Professional18 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ESP · Espionage

MITRE ATT&CK · 56 techniques

Resource Development · 2

T1583.003Virtual Private Server T1583.006Web Services

Initial Access · 1

T1566.001Spearphishing Attachment

Execution · 7

T1047Windows Management Instrumentation T1053.005Scheduled Task T1059.001PowerShell T1059.003Windows Command Shell T1059.005Visual Basic T1106Native API T1204.001Malicious Link

Persistence · 2

T1137Office Application Startup T1547.001Registry Run Keys / Startup Folder

Discovery · 5

T1012Query Registry T1033System Owner/User Discovery T1057Process Discovery T1083File and Directory Discovery T1120Peripheral Device Discovery

Lateral Movement · 4

T1021.005VNC T1080Taint Shared Content T1091Replication Through Removable Media T1534Internal Spearphishing

Collection · 5

T1005Data from Local System T1025Data from Removable Media T1039Data from Network Shared Drive T1113Screen Capture T1119Automated Collection

Exfiltration · 2

T1020Automated Exfiltration T1041Exfiltration Over C2 Channel

Impact · 1

T1561.001Disk Content Wipe

Command And Control · 11

T1001Data Obfuscation T1071.001Web Protocols T1090Proxy T1090.003Multi-hop Proxy T1095Non-Application Layer Protocol T1102Web Service T1102.002Bidirectional Communication T1102.003One-Way Communication T1105Ingress Tool Transfer T1568Dynamic Resolution T1571Non-Standard Port

Defense Impairment · 2

T1112Modify Registry T1685Disable or Modify Tools

Stealth · 14

T1027Obfuscated Files or Information T1027.004Compile After Delivery T1027.010Command Obfuscation T1027.015Compression T1036.005Match Legitimate Resource Name or Location T1055Process Injection T1070.004File Deletion T1140Deobfuscate/Decode Files or Information T1218.005Mshta T1218.011Rundll32 T1221Template Injection T1480Execution Guardrails T1564.003Hidden Window T1620Reflective Code Loading

GIR coverage

0 / 480 requirements satisfied

Open matrix

No GIRs mapped yet for this actor.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer56 techniques · layer format 4.5

Related actors

By origin and actor type