Trusted Design

Gamaredon Group

アクターID: G0047

· MITRE Pageへのリンク

脅威アクターの詳細

Gamaredon Group is a suspected Russian cyber espionage group that has targeted military, law enforcement, judiciary, non-profit, and non-governmental organizations in Ukraine since at least 2013. The name Gamaredon Group derives from a misspelling of the word "Armageddon," found in early campaigns.(Citation: Palo Alto Gamaredon Feb 2017)(Citation: TrendMicro Gamaredon April 2020)(Citation: ESET Gamaredon June 2020)(Citation: Symantec Shuckworm January 2022)(Citation: Microsoft Actinium February 2022)

In November 2021, the Ukrainian government publicly attributed Gamaredon Group to Russia’s Federal Security Service (FSB) Center 18, an assessment later supported by multiple independent cybersecurity researchers. (Citation: Bleepingcomputer Gamardeon FSB November 2021)(Citation: Microsoft Actinium February 2022)

脅威アクターの別名・別称

Gamaredon Group
IRON TILDEN
Primitive Bear
ACTINIUM
Armageddon
Shuckworm
DEV-0157
Aqua Blizzard

利用した攻撃手法

• T1053.005 - Scheduled Task
• T1021.005 - VNC
• T1047 - Windows Management Instrumentation
• T1156 - Malicious Shell Modification
• T1557 - Adversary-in-the-Middle
• T1583 - Acquire Infrastructure
• T1099 - Timestomp
• T1552.005 - Cloud Instance Metadata API
• T1218.013 - Mavinject
• T1093 - Process Hollowing
• T1087.002 - Domain Account
• T1591.003 - Identify Business Tempo
• T1527 - Application Access Token
• T1562.009 - Safe Mode Boot
• T1069.002 - Domain Groups
• T1598.003 - Spearphishing Link
• T1547.012 - Print Processors
• T1487 - Disk Structure Wipe
• T1040 - Network Sniffing
• T1120 - Peripheral Device Discovery
• T1590.003 - Network Trust Dependencies
• T1058 - Service Registry Permissions Weakness
• T1584.003 - Virtual Private Server
• T1059.010 - AutoHotKey & AutoIT
• T1091 - Replication Through Removable Media
• T1098.007 - Additional Local or Domain Groups
• T1684 - Social Engineering
• T1205 - Traffic Signaling
• T1059.009 - Cloud API
• T1092 - Communication Through Removable Media
• T1045 - Software Packing
• T1090 - Proxy
• T1175 - Component Object Model and Distributed COM
• T1219.001 - IDE Tunneling
• T1036.002 - Right-to-Left Override
• T1612 - Build Image on Host
• T1218.012 - Verclsid
• T1562.010 - Downgrade Attack
• T1608 - Stage Capabilities
• T1608.005 - Link Target
• T1606.001 - Web Cookies
• T1583.006 - Web Services
• T1087.004 - Cloud Account
• T1497.002 - User Activity Based Checks
• T1554 - Compromise Host Software Binary
• T1055.014 - VDSO Hijacking
• T1679 - Selective Exclusion
• T1199 - Trusted Relationship
• T1056.002 - GUI Input Capture
• T1597 - Search Closed Sources
• T1061 - Graphical User Interface
• T1542.004 - ROMMONkit
• T1562.001 - Disable or Modify Tools
• T1059.011 - Lua
• T1547.002 - Authentication Package
• T1203 - Exploitation for Client Execution
• T1570 - Lateral Tool Transfer
• T1059.013 - Container CLI/API
• T1506 - Web Session Cookie
• T1553.004 - Install Root Certificate
• T1591.004 - Identify Roles
• T1601.001 - Patch System Image
• T1070.009 - Clear Persistence
• T1200 - Hardware Additions
• T1556.005 - Reversible Encryption
• T1027.010 - Command Obfuscation
• T1547.013 - XDG Autostart Entries
• T1027.018 - Invisible Unicode
• T1086 - PowerShell
• T1546.017 - Udev Rules

関連するCVE (攻撃手法に関連)

• CVE-2014-4114 (T1027.018)
• CVE-2017-0143 (T1027.018)
• CVE-2013-3906 (T1601.001)
• CVE-2013-6282 (T1059.013)
• CVE-2012-1856 (T1027.018)
• CVE-2014-6332 (T1027.018)
• CVE-2012-0158 (T1027.018)
• CVE-2015-1701 (T1027.018)
• CVE-2012-4969 (T1027.018)
• CVE-2014-1776 (T1027.018)
• CVE-2013-3660 (T1027.018)
• CVE-2010-0806 (T1027.018)
• CVE-2015-2360 (T1027.018)
• CVE-2010-4398 (T1027.018)
• CVE-2015-1770 (T1027.018)
• CVE-2015-2545 (T1027.018)
• CVE-2017-0199 (T1027.018)
• CVE-2014-6352 (T1027.010)
• CVE-2015-0016 (T1027.018)
• CVE-2010-3333 (T1027.018)
• CVE-2010-0188 (T1027.018)
• CVE-2010-2884 (T1591.004)
• CVE-2013-0640 (T1591.004)
• CVE-2011-0611 (T1591.004)
• CVE-2009-3129 (T1027.018)
• CVE-2014-1761 (T1059.013)
• CVE-2010-1553 (T1027.018)
• CVE-2015-2853 (T1027.018)
• CVE-2017-16929 (T1027.018)
• CVE-2012-1876 (T1027.018)
• CVE-2012-2539 (T1027.018)
• CVE-2013-7331 (T1200)
• CVE-2013-5990 (T1027.018)
• CVE-2015-0097 (T1027.018)
• CVE-2015-2502 (T1027.018)
• CVE-2012-1889 (T1059.013)
• CVE-2012-4792 (T1027.018)
• CVE-2014-0322 (T1027.018)
• CVE-2013-2551 (T1027.018)
• CVE-2014-4148 (T1027.018)
• CVE-2017-8570 (T1027.018)
• CVE-2016-0189 (T1027.018)
• CVE-2015-0310 (T1597)
• CVE-2015-2546 (T1027.018)
• CVE-2015-5897 (T1597)
• CVE-2015-4495 (T1059.013)
• CVE-2014-4113 (T1027.018)
• CVE-2017-0263 (T1027.018)
• CVE-2014-8361 (T1556.005)
• CVE-2015-0057 (T1027.018)
• CVE-2010-0232 (T1027.018)
• CVE-2012-6422 (T1059.013)
• CVE-2025-24893 (T1027.018)
• CVE-2015-5119 (T1027.018)
• CVE-2015-5122 (T1027.018)
• CVE-2015-3043 (T1027.018)
• CVE-2015-3090 (T1027.018)
• CVE-2015-2590 (T1027.018)
• CVE-2015-2424 (T1027.018)
• CVE-2014-6271 (T1027.018)
• CVE-2016-1010 (T1027.018)
• CVE-2016-0984 (T1027.018)
• CVE-2016-0998 (T1027.018)
• CVE-2015-1641 (T1027.018)
• CVE-2015-0313 (T1027.018)
• CVE-2015-0359 (T1027.018)
• CVE-2014-0329 (T1027.018)
• CVE-2015-5130 (T1027.018)
• CVE-2015-5134 (T1027.018)
• CVE-2015-5539 (T1027.018)
• CVE-2015-5557 (T1027.018)
• CVE-2015-5563 (T1027.018)
• CVE-2015-5559 (T1027.018)
• CVE-2015-5540 (T1027.018)
• CVE-2015-5561 (T1027.018)
• CVE-2015-5551 (T1027.018)
• CVE-2015-5564 (T1027.018)
• CVE-2015-5565 (T1027.018)
• CVE-2015-5550 (T1027.018)
• CVE-2015-5566 (T1027.018)
• CVE-2015-5127 (T1027.018)
• CVE-2015-5556 (T1027.018)
• CVE-2015-3628 (T1059.013)
• CVE-2015-6034 (T1061)
• CVE-2015-2852 (T1027.018)
• CVE-2015-6585 (T1059.013)
• CVE-2015-6022 (T1027.018)
• CVE-2015-8287 (T1055.014)
• CVE-2016-2343 (T1218.012)
• CVE-2017-0261 (T1027.018)
• CVE-2017-0262 (T1027.018)
• CVE-2016-9494 (T1027.018)
• CVE-2016-9496 (T1027.018)
• CVE-2016-9495 (T1027.018)
• CVE-2025-55182 (T1027.018)
• CVE-2015-0311 (T1027.018)
• CVE-2010-3081 (T1218.012)
• CVE-2012-3213 (T1027.018)
• CVE-2015-0336 (T1027.018)
• CVE-2011-3544 (T1027.018)
• CVE-2014-7911 (T1059.013)
• CVE-2015-3636 (T1597)
• CVE-2015-3105 (T1059.013)
• CVE-2017-17215 (T1027.018)
• CVE-2013-0074 (T1027.018)
• CVE-2012-0507 (T1027.018)
• CVE-2013-2465 (T1027.018)
• CVE-2012-4681 (T1027.018)
• CVE-2014-0556 (T1027.018)
• CVE-2015-0071 (T1027.018)
• CVE-2012-1723 (T1027.018)
• CVE-2015-1761 (T1027.018)
• CVE-2014-8440 (T1027.018)
• CVE-2011-3402 (T1027.018)
• CVE-2014-6324 (T1027.018)
• CVE-2014-7247 (T1027.018)
• CVE-2013-2678 (T1027.018)
• CVE-2015-2426 (T1027.018)
• CVE-2008-1436 (T1597)
• CVE-2013-2595 (T1200)
• CVE-2015-4902 (T1027.018)
• CVE-2014-3897 (T1027.018)
• CVE-2015-2387 (T1027.018)
• CVE-2010-2572 (T1027.018)
• CVE-2011-1255 (T1027.018)
• CVE-2012-0611 (T1027.018)
• CVE-2015-2419 (T1027.018)
• CVE-2016-4117 (T1059.013)
• CVE-2017-0001 (T1027.018)
• CVE-2023-1389 (T1027.018)
• CVE-2025-31125 (T1027.018)
• CVE-2025-34026 (T1027.018)
• CVE-2025-55183 (T1027.018)
• CVE-2025-55184 (T1027.018)
• CVE-2025-66478 (T1055.014)
• CVE-2025-68645 (T1027.018)
• CVE-2026-20127 (T1027.018)
• CVE-2026-0723 (T1055.014)
• CVE-2014-4322 (T1597)
• CVE-2015-7261 (T1027.018)
• CVE-2015-8286 (T1092)
• CVE-2016-2342 (T1059.013)
• CVE-2016-6532 (T1218.012)
• CVE-2015-3785 (T1597)
• CVE-2012-0056 (T1218.012)
• CVE-2015-3113 (T1059.013)
• CVE-2016-1990 (T1059.013)
• CVE-2016-1991 (T1059.013)
• CVE-2016-1019 (T1059.013)
• CVE-2016-1001 (T1059.013)
• CVE-2015-2854 (T1027.018)
• CVE-2012-1258 (T1219.001)
• CVE-2014-3153 (T1597)
• CVE-2014-0497 (T1059.013)
• CVE-2014-8439 (T1059.013)
• CVE-2014-0569 (T1059.013)
• CVE-2014-0515 (T1059.013)
• CVE-2015-5560 (T1059.013)
• CVE-2014-9163 (T1059.013)
• CVE-2014-3393 (T1597)
• CVE-2014-2273 (T1059.013)
• CVE-2016-1562 (T1059.013)
• CVE-2015-1427 (T1059.013)
• CVE-2015-7645 (T1027.018)
• CVE-2017-12149 (T1027.018)
• CVE-2015-3456 (T1059.013)
• CVE-2015-5477 (T1218.012)
• CVE-2013-2094 (T1027.018)
• CVE-2015-8562 (T1027.018)
• CVE-2015-7808 (T1059.013)
• CVE-2015-5749 (T1059.013)
• CVE-2015-7755 (T1608.005)
• CVE-2016-1287 (T1059.013)
• CVE-2015-6036 (T1027.018)
• CVE-2015-7262 (T1055.014)
• CVE-2017-3212 (T1059.013)
• CVE-2015-0932 (T1059.013)
• CVE-2010-1297 (T1027.018)
• CVE-2010-2883 (T1591.004)
• CVE-2013-0634 (T1059.013)
• CVE-2012-5054 (T1059.013)
• CVE-2010-0738 (T1055.014)
• CVE-2013-0641 (T1591.004)
• CVE-2017-7255 (T1597)
• CVE-2025-13335 (T1562.001)
• CVE-2025-13927 (T1055.014)
• CVE-2025-13928 (T1055.014)
• CVE-2026-1102 (T1055.014)
• CVE-2016-1898 (T1027.018)
• CVE-2016-1897 (T1027.018)
• CVE-2025-61882 (T1200)

Actor – Pulse グラフ

---

← 脅威アクター一覧に戻る