Actors/Nation-state / APT/Europe

Gamaredon Group

APTRU · Russia

AKA BlueAlpha · ACTINIUM · UAC-0010 · WINTERFLOUNDER · Shuckworm · Trident Ursa · DEV-0157 · Armageddon

CrowdStrike: PRIMITIVE BEARMandiant: UNC530Microsoft: Aqua BlizzardSecureworks: IRON TILDEN

FSB-attributed cyber group operating against Ukraine since 2013.

Targets5

Sectors4

Threat types1

GIRs covered0/480

Active since2013

Victimology

Geographic footprint · 5 countries

origin · Russiatargeted countries · 5

EUROPE · 5

Lithuania · Latvia · Moldova · Poland · Ukraine

Sectors targeted

4 of 40

Government83 actors Defense60 actors Education & Research50 actors Legal & Professional13 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ESP · Espionage

MITRE ATT&CK · 56 techniques

Resource Development · 2

T1583.003Virtual Private Server T1583.006Web Services

Initial Access · 1

T1566.001Spearphishing Attachment

Execution · 7

T1047Windows Management Instrumentation

Persistence · 2

T1137Office Application Startup

Discovery · 5

T1012Query Registry T1033System Owner/User Discovery

Lateral Movement · 4

T1021.005VNC

Collection · 5

T1005Data from Local System T1025Data from Removable Media T1039Data from Network Shared Drive T1113Screen Capture

Exfiltration · 2

T1020Automated Exfiltration T1041Exfiltration Over C2 Channel

Impact · 1

T1561.001Disk Content Wipe

Command And Control · 11

T1001Data Obfuscation T1071.001Web Protocols T1090Proxy

Defense Impairment · 2

T1112Modify Registry

Stealth · 14

T1027Obfuscated Files or Information T1027.004

GIR coverage

0 / 480 requirements satisfied

Open matrix

No GIRs mapped yet for this actor.

Related actors

By origin and actor type

T1053.005

Scheduled Task

T1059.001PowerShell

T1059.003Windows Command Shell

T1059.005Visual Basic

T1106Native API

T1204.001Malicious Link

T1547.001

Registry Run Keys / Startup Folder

T1057

Process Discovery

T1083File and Directory Discovery

T1120Peripheral Device Discovery

T1080

Taint Shared Content

T1091Replication Through Removable Media

T1534Internal Spearphishing

T1119

Automated Collection

T1090.003

Multi-hop Proxy

T1095Non-Application Layer Protocol

T1102Web Service

T1102.002Bidirectional Communication

T1102.003One-Way Communication

T1105Ingress Tool Transfer

T1568Dynamic Resolution

T1571Non-Standard Port

T1685

Disable or Modify Tools

Compile After Delivery

T1027.010Command Obfuscation

T1027.015Compression

T1036.005Match Legitimate Resource Name or Location

T1055Process Injection

T1070.004File Deletion

T1140Deobfuscate/Decode Files or Information

T1218.005Mshta

T1218.011Rundll32

T1221Template Injection

T1480Execution Guardrails

T1564.003Hidden Window

T1620Reflective Code Loading