Gamaredon Group
IntrusionSet · ATTACK:enterprise:G0047
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G0047",
"title": "Gamaredon Group",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G0047",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--2e290bfe-93b5-48ce-97d6-edcd6d32b7cf",
"external_id": "G0047",
"domain": "enterprise",
"created": "2017-05-31T21:32:09.849Z",
"modified": "2026-10-01T23:37:12.271Z",
"version": "3.4",
"aliases": [
"Gamaredon Group",
"IRON TILDEN",
"Primitive Bear",
"ACTINIUM",
"Armageddon",
"Shuckworm",
"DEV-0157",
"Aqua Blizzard",
"NastyShrew"
],
"tactics": [
],
"source_references": [
{
"source_name": "Cloudflare 2026 Threat Report New Threat Actors March 2026",
"url": "https://blog.cloudflare.com/2026-threat-report/"
},
{
"source_name": "NastyShrew"
},
{
"source_name": "ACTINIUM"
},
{
"source_name": "DEV-0157"
},
{
"source_name": "Aqua Blizzard"
},
{
"source_name": "Gamaredon Group"
},
{
"source_name": "IRON TILDEN"
},
{
"source_name": "Armageddon"
},
{
"source_name": "Shuckworm"
},
{
"source_name": "Primitive Bear"
},
{
"source_name": "ESET Gamaredon June 2020",
"url": "https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"
},
{
"source_name": "TrendMicro Gamaredon April 2020",
"url": "https://blog.trendmicro.com/trendlabs-security-intelligence/gamaredon-apt-group-use-covid-19-lure-in-campaigns/"
},
{
"source_name": "Palo Alto Gamaredon Feb 2017",
"url": "https://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution/"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Microsoft Actinium February 2022",
"url": "https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/"
},
{
"source_name": "Secureworks IRON TILDEN Profile",
"url": "https://www.secureworks.com/research/threat-profiles/iron-tilden"
},
{
"source_name": "Symantec Shuckworm January 2022",
"url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine"
},
{
"source_name": "Bleepingcomputer Gamardeon FSB November 2021",
"url": "https://www.bleepingcomputer.com/news/security/ukraine-links-members-of-gamaredon-hacker-group-to-russian-fsb/"
},
{
"source_name": "Unit 42 Gamaredon February 2022",
"url": "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"
}
]
}Explicit source assertions (76)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1491.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--09677a24-20ac-4983-a97f-f1b54282b609
CERT-EE Gamaredon January 2021ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1583.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--09f8f0a2-a94f-466e-af4f-cf29ca6794c7
Huntio_GamaredonFlux_Apr2025 · ESET Gamaredon Sept2024 · unit42_gamaredon_dec2022ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0e2c026d-042b-4ccb-b2d1-8ca6308ea506
unit42_gamaredon_dec2022ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1534
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--109bbda3-f97a-4067-81d6-ed635f251282
ESET Gamaredon June 2020ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--12e24dfb-3b4c-4244-90c9-2f9675dc6eaa
CERT-EE Gamaredon January 2021 · ESET Gamaredon Sept2024 · SymantecCarbonBlack_ShuckwormUSB_Apr2025 · unit42_gamaredon_dec2022ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1095
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--15025556-2b38-40de-98a0-e231a16a7949
SymantecCarbonBlack_ShuckwormUSB_Apr2025ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--16b915ff-7bf5-4032-b39a-9c8073847d77
ESET Gamaredon June 2020 · ESET Gamaredon Sept2024 · SymantecCarbonBlack_ShuckwormUSB_Apr2025 · Unit 42 Gamaredon February 2022ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1091
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1b91f271-feb7-4abe-b1c1-ffee0bceedfd
SymantecCarbonBlack_ShuckwormUSB_Apr2025ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1119
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1de5c5fb-ba73-446b-8596-225cb5bcb611
ESET Gamaredon June 2020ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e049e66-14ce-46d5-8af1-d93ea35f4aec
Unit 42 Gamaredon February 2022 · VenereCiscoTalos_Gamaredon_Mar2025ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1027.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2278eb19-1ff4-4406-ab79-03108732330c
ESET Gamaredon June 2020ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--253b56a5-232f-44bc-af4d-85ccc12a0577
ESET Gamaredon June 2020 · TrendMicro Gamaredon April 2020 · Palo Alto Gamaredon Feb 2017 · Microsoft Actinium February 2022 · ESET Gamaredon Sept2024 · unit42_gamaredon_dec2022 · VenereCiscoTalos_Gamaredon_Mar2025ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1021.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--27bf147a-1e8b-481d-8910-3af3e64aa18c
Microsoft Actinium February 2022 · Symantec Shuckworm January 2022 · Unit 42 Gamaredon February 2022ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1027.016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--28c17b23-901c-46d5-84f2-544401f68d83
ESET Gamaredon June 2020ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--29e9bfd8-e2d3-4e25-8683-6605d99538de
ESET Gamaredon June 2020ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:S0686
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3151bdb1-baa0-4098-ac1c-a98cc72d0a84
Microsoft Actinium February 2022ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--35624bc2-caf0-4124-88e8-6f60ae52ed9c
ESET Gamaredon June 2020 · CERT-EE Gamaredon January 2021 · TrendMicro Gamaredon April 2020 · Microsoft Actinium February 2022 · ESET Gamaredon Sept2024 · Secureworks IRON TILDEN Profile · SilentPush_GamaredonFastFlux_Sept2023 · unit42_gamaredon_dec2022 · Unit 42 Gamaredon February 2022 · VenereCiscoTalos_Gamaredon_Mar2025ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--36112f24-7814-4c75-b5b7-a1205bb28b68
CERT-EE Gamaredon January 2021 · TrendMicro Gamaredon April 2020 · Palo Alto Gamaredon Feb 2017 · ESET Gamaredon Sept2024 · SymantecCarbonBlack_ShuckwormUSB_Apr2025ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3a6022ea-7647-4d61-8103-dd354d8dfd4d
ESET Gamaredon June 2020 · CERT-EE Gamaredon January 2021 · TrendMicro Gamaredon April 2020 · Microsoft Actinium February 2022 · ESET Gamaredon Sept2024 · Secureworks IRON TILDEN Profile · SymantecCarbonBlack_ShuckwormUSB_Apr2025ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3a9117f6-9244-4d09-a69b-43afbb4d2998
ESET Gamaredon June 2020 · ESET Gamaredon Sept2024 · SymantecCarbonBlack_ShuckwormUSB_Apr2025ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3db3a6a7-5fa4-4a66-86b6-5df1732a8e96
SymantecCarbonBlack_ShuckwormUSB_Apr2025ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--430afd29-f2c0-43d3-b7bf-e7a549960254
ESET Gamaredon June 2020 · ESET Gamaredon Sept2024ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4716b9ec-a0d4-47db-a901-5a3b67d9e096
ESET Gamaredon June 2020 · ESET Gamaredon Sept2024ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1608.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4973197d-b2b7-4da2-ad4f-245beca0b389
Microsoft Actinium February 2022 · Unit 42 Gamaredon February 2022ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1027.015
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4cb3f85c-491a-4f5d-a85a-b3f2791b697e
VenereCiscoTalos_Gamaredon_Mar2025ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:S0147
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4f33536d-eb06-4eba-8765-4379e399f3b8
Palo Alto Gamaredon Feb 2017 · Symantec Shuckworm January 2022 · Microsoft Actinium February 2022 · Unit 42 Gamaredon February 2022 · Secureworks IRON TILDEN ProfileATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1102.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--524d0765-bef8-4146-b218-aa8a20719348
unit42_gamaredon_dec2022ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5edb6931-3262-40a9-acce-3016ac4153d4
ESET Gamaredon June 2020 · CERT-EE Gamaredon January 2021 · ESET Gamaredon Sept2024 · SymantecCarbonBlack_ShuckwormUSB_Apr2025ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1016.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5fc69974-db3b-4475-b37b-07c4731b1a6f
Symantec Shuckworm January 2022 · SymantecCarbonBlack_ShuckwormUSB_Apr2025ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1620
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--605484fa-0a3e-48df-b5bb-9ff0a35593fc
SymantecCarbonBlack_ShuckwormUSB_Apr2025ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1559.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--69513daf-2acd-4b04-a7be-9f31174a2ae9
ESET Gamaredon June 2020 · ESET Gamaredon Sept2024ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--749a620d-a87e-45b7-a9f6-8fa926320c59
SymantecCarbonBlack_ShuckwormUSB_Apr2025ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1025
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--788e8246-d835-42c6-b8b4-7efad31e4a84
ESET Gamaredon June 2020 · Palo Alto Gamaredon Feb 2017 · ESET Gamaredon Sept2024ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:S0332
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7c7b3761-80ff-4469-ad5b-9cc9a26078db
VenereCiscoTalos_Gamaredon_Mar2025ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1221
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7cabf1a6-5ad3-4c5d-83e8-161d49e082ac
ESET Gamaredon June 2020 · CERT-EE Gamaredon January 2021 · TrendMicro Gamaredon April 2020 · Microsoft Actinium February 2022 · Proofpoint RTF Injection · ESET Gamaredon Sept2024 · Secureworks IRON TILDEN Profile · Unit 42 Gamaredon February 2022ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7da2fa27-ae11-4955-9dff-b2e2d24d6548
ESET Gamaredon June 2020 · ESET Gamaredon Sept2024ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--86bcc5c3-456e-4bac-a419-54f54af80325
ESET Gamaredon June 2020 · TrendMicro Gamaredon April 2020 · ESET Gamaredon Sept2024 · unit42_gamaredon_dec2022ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1204.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9730ebe6-78b7-4dbf-93f4-add720033985
ESET Gamaredon Sept2024 · unit42_gamaredon_dec2022ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1080
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9b2ff8c9-3811-4615-a0c7-d79a14b7ade6
ESET Gamaredon June 2020ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9c51f7a2-346b-4ef9-ade0-ac2c5c845c27
ESET Gamaredon June 2020 · ESET Gamaredon Sept2024ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9f41dd16-b4c0-445d-b298-5a56621dfcf1
SymantecCarbonBlack_ShuckwormUSB_Apr2025ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1561.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a2e09ef2-2511-476b-8759-264843b4d772
CERT-EE Gamaredon January 2021ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a5ffea60-7694-48cd-92e9-b755669b2fdb
Palo Alto Gamaredon Feb 2017ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1587.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a7c7a560-9ad7-4c8e-b147-00d8a4c06fe2
Huntio_GamaredonFlux_Apr2025ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a987bd4f-dcb3-4fa8-8ca3-b76cfea921f6
Unit 42 Gamaredon February 2022 · VenereCiscoTalos_Gamaredon_Mar2025ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1027.012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ad3eb297-d989-492a-9969-031444e0ccc6
SymantecCarbonBlack_ShuckwormUSB_Apr2025 · VenereCiscoTalos_Gamaredon_Mar2025ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bda5489b-7735-4793-8816-fc2238f6957f
CERT-EE Gamaredon January 2021 · TrendMicro Gamaredon April 2020 · ESET Gamaredon Sept2024 · Symantec Shuckworm January 2022ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c14a954c-5d6d-4f29-8542-934e0fa5e9d3
Microsoft Actinium February 2022 · ESET Gamaredon Sept2024 · SymantecCarbonBlack_ShuckwormUSB_Apr2025 · VenereCiscoTalos_Gamaredon_Mar2025ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1571
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c308ceda-6c7c-4f7f-847b-e64f992d0104
VenereCiscoTalos_Gamaredon_Mar2025ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c4cced3e-4a44-48e0-a299-63a03c63b598
ESET Gamaredon Sept2024 · unit42_gamaredon_dec2022ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1020
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c623d41f-3af0-4e3a-bf4f-8550bec85b37
ESET Gamaredon June 2020ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c63c7dc5-e374-4bf0-9839-0f940ac6d46c
ESET Gamaredon June 2020 · CERT-EE Gamaredon January 2021 · TrendMicro Gamaredon April 2020 · Palo Alto Gamaredon Feb 2017 · ESET Gamaredon Sept2024 · Symantec Shuckworm January 2022 · unit42_gamaredon_dec2022 · Unit 42 Gamaredon February 2022 · VenereCiscoTalos_Gamaredon_Mar2025ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1583.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ccdab928-86cd-4e6d-b477-0ec156f6105a
Microsoft Actinium February 2022 · ESET Gamaredon Sept2024 · SymantecCarbonBlack_ShuckwormUSB_Apr2025 · Unit 42 Gamaredon February 2022ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1568.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cf344f67-2bd0-400d-a90f-eb216761a192
Huntio_GamaredonFlux_Apr2025 · ESET Gamaredon Sept2024 · SilentPush_GamaredonFastFlux_Sept2023 · unit42_gamaredon_dec2022ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1055
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cfe83f83-f0d8-4e17-a396-5571189910fa
VenereCiscoTalos_Gamaredon_Mar2025ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1120
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d30d8fa0-7f24-41e5-ae8d-e4449e88d2f0
ESET Gamaredon June 2020 · Palo Alto Gamaredon Feb 2017 · ESET Gamaredon Sept2024ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d361058d-a11b-470d-bed8-44bfd8e50393
Palo Alto Gamaredon Feb 2017 · ESET Gamaredon Sept2024 · SymantecCarbonBlack_ShuckwormUSB_Apr2025ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1090.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d57d2087-dfcf-40d4-904a-27907c321545
SymantecCarbonBlack_ShuckwormUSB_Apr2025ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d65c9c85-2206-46c0-b55b-4fe2bd022c41
ESET Gamaredon June 2020 · CERT-EE Gamaredon January 2021 · Microsoft Actinium February 2022 · unit42_gamaredon_dec2022ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:S0097
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d77885d0-46e0-47b7-9cc2-6a396c570b12
Symantec Shuckworm January 2022ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:S0075
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--db221583-6145-4b65-8eb8-f5e59b1c9e59
unit42_gamaredon_dec2022ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dd84b767-1623-421b-8f31-048924be5f17
ESET Gamaredon June 2020 · SymantecCarbonBlack_ShuckwormUSB_Apr2025ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dfe4c167-8e69-4b15-912f-ccd437674423
Symantec Shuckworm January 2022 · SymantecCarbonBlack_ShuckwormUSB_Apr2025 · Unit 42 Gamaredon February 2022ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1027.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e17c193a-d616-42d3-9525-940f3424c96c
ESET Gamaredon June 2020 · Microsoft Actinium February 2022 · ESET Gamaredon Sept2024 · SymantecCarbonBlack_ShuckwormUSB_Apr2025ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:S0685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e1b5c306-3f7a-4d69-b30f-450b9054679a
Microsoft Actinium February 2022ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e84791af-7bdb-4fe9-8e03-7a10a154c9a4
ESET Gamaredon June 2020 · CERT-EE Gamaredon January 2021 · TrendMicro Gamaredon April 2020 · Microsoft Actinium February 2022 · Secureworks IRON TILDEN Profile · Symantec Shuckworm January 2022 · unit42_gamaredon_dec2022 · Unit 42 Gamaredon February 2022 · VenereCiscoTalos_Gamaredon_Mar2025ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1568
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eb77b635-6f00-4975-b36e-63c7a5c48e3c
Unit 42 Gamaredon February 2022ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1090
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eb8f0f7c-a37f-4c73-8c75-50d650ae5960
ESET Gamaredon Sept2024ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f2d0fd0d-7bfc-4f3e-bd78-2d691c476046
ESET Gamaredon June 2020 · CERT-EE Gamaredon January 2021 · TrendMicro Gamaredon April 2020 · ESET Gamaredon Sept2024 · unit42_gamaredon_dec2022ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1480
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f523a64f-7c27-4c23-a35d-c56b4bcce8be
unit42_gamaredon_dec2022 · VenereCiscoTalos_Gamaredon_Mar2025ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1102.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f62632c0-cddf-40ba-bba0-647b5c523606
ESET Gamaredon Sept2024 · SymantecCarbonBlack_ShuckwormUSB_Apr2025ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f73df541-6b55-42d1-aec3-53660fda1508
Palo Alto Gamaredon Feb 2017 · ESET Gamaredon June 2020 · CERT-EE Gamaredon January 2021 · Unit 42 Gamaredon February 2022ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f76be4ac-f342-4904-b50d-06e28b878011
ESET Gamaredon Sept2024 · Symantec Shuckworm January 2022 · SymantecCarbonBlack_ShuckwormUSB_Apr2025 · unit42_gamaredon_dec2022ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1137
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f78a5009-59ec-4ae2-89a0-44b8be49a140
ESET Gamaredon June 2020ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1102
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fa7887c3-d49d-4499-9ee4-f9a504ce7dec
ESET Gamaredon June 2020ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1497.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fea46319-ea16-4e74-a2a7-b41b148413bf
SilentPush_GamaredonFastFlux_Sept2023