Gamaredon Group

Origin🇷🇺 Rússia

Techniques (MITRE ATT&CK)70

SourceMITRE ATT&CK

Target categories: Government

Targeted regions: Ukraine · Germany

Also known as:ACTINIUMActiniumAqua BlizzardArmageddonBlue OtsoBlueAlphaDEV-0157G0047IRON TILDENNastyShrewPRIMITIVE BEARPrimitive BearShuckwormTrident UrsaUAC-0010Winterflounder

About the group

Gamaredon Group is a suspected Russian cyber espionage group that has targeted military, law enforcement, judiciary, non-profit, and non-governmental organizations in Ukraine since at least 2013. The name Gamaredon Group derives from a misspelling of the word "Armageddon," found in early campaigns. In November 2021, the Ukrainian government publicly attributed Gamaredon Group to Russia’s Federal Security Service (FSB) Center 18, an assessment later supported by multiple independent cybersecurity researchers.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity59

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 70

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Resource development

Domains Virtual Private Server Web Services Digital Certificates Tool Upload Malware

Initial access

Spearphishing Attachment

Execution

Windows Management Instrumentation Scheduled Task PowerShell Windows Command Shell Visual Basic Native API Malicious Link Malicious File Component Object Model

Persistence

Office Application Startup Registry Run Keys / Startup Folder

Discovery

Query Registry Internet Connection Discovery System Owner/User Discovery Process Discovery System Information Discovery File and Directory Discovery Peripheral Device Discovery Security Software Discovery

Lateral movement

VNC Taint Shared Content Replication Through Removable Media Internal Spearphishing

Collection

Data from Local System Data from Removable Media Data from Network Shared Drive Screen Capture Automated Collection

Command and control

Data Obfuscation Web Protocols Proxy Multi-hop Proxy Non-Application Layer Protocol Web Service Bidirectional Communication One-Way Communication Ingress Tool Transfer Dynamic Resolution Fast Flux DNS Non-Standard Port

Exfiltration

Automated Exfiltration Exfiltration Over C2 Channel

Impact

Internal Defacement Disk Content Wipe

defense-impairment

Modify Registry Disable or Modify Tools

stealth

Obfuscated Files or Information Compile After Delivery Command Obfuscation LNK Icon Smuggling Compression Junk Code Insertion Match Legitimate Resource Name or Location Process Injection File Deletion Deobfuscate/Decode Files or Information Mshta Rundll32 Template Injection Execution Guardrails System Checks Hidden Window Reflective Code Loading

Exploited vulnerabilities

No CVEs attributed to this group in public sources (MITRE ATT&CK). Absence of attribution does not mean absence of activity.

Known infrastructure 1287

Real indicators (C2, domains, URLs and hashes) associated with the malware this group uses. Source: abuse.ch (ThreatFox, URLhaus, MalwareBazaar).

ip:port45.128.234.124:443Remcosthreatfox

ip:port198.135.49.110:4489Remcosthreatfox

ip:port37.120.206.165:60507Remcosthreatfox

ip:port103.83.87.86:2404Remcosthreatfox

ip:port185.149.24.115:2404Remcosthreatfox

ip:port128.90.108.225:2424Remcosthreatfox

ip:port103.83.86.40:14642Remcosthreatfox

ip:port31.59.137.81:4565Remcosthreatfox

domainjustily.duckdns.orgRemcosthreatfox

ip:port128.90.108.89:2424Remcosthreatfox

ip:port103.254.61.170:3889Remcosthreatfox

ip:port194.116.236.83:15800Remcosthreatfox

ip:port46.246.14.21:5987Remcosthreatfox

ip:port204.44.93.119:7878Remcosthreatfox

ip:port128.90.108.50:2424Remcosthreatfox

ip:port128.90.102.194:2015Remcosthreatfox

ip:port43.228.157.72:1208Remcosthreatfox

ip:port102.220.163.130:14644Remcosthreatfox

ip:port128.90.108.109:2405Remcosthreatfox

ip:port84.32.41.212:443Remcosthreatfox

ip:port194.116.236.83:2404Remcosthreatfox

ip:port194.116.236.83:15700Remcosthreatfox

ip:port185.214.10.188:2404Remcosthreatfox

ip:port172.111.137.68:65070Remcosthreatfox

ip:port155.103.71.210:55280Remcosthreatfox

ip:port78.40.209.168:2404Remcosthreatfox

domainwww.mrfixitmrfixitlocalplcbackup.comRemcosthreatfox

domainwww.mrfixitmrfixitlocalplc1.comRemcosthreatfox

domainwww.mrfixitmrfixitlocalplc.comRemcosthreatfox

ip:port172.111.137.69:65070Remcosthreatfox

+1287 indicators in total. See them all on the IOCs page.

References

Gamaredon Group uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →