Actors/Nation-state / APT/Europe

Gamaredon Group

G0047APTRU · Russia

AKA BlueAlpha · ACTINIUM · UAC-0010 · WINTERFLOUNDER · Shuckworm · Trident Ursa · DEV-0157 · Armageddon

CrowdStrike: PRIMITIVE BEARESET: GamaredonMandiant: UNC530Microsoft: Aqua BlizzardMITRE: G0047Secureworks: IRON TILDEN

FSB-attributed cyber group operating against Ukraine since 2013.

Targets5

Sectors4

Threat types1

GIRs covered0/480

Active since2013

Also tracked as

6 vendor names · 8 other aliases

Open Rosetta Stone

CrowdStrike

PRIMITIVE BEAR

ESET

Gamaredon

Mandiant

UNC530

Microsoft

Aqua Blizzard

MITRE

G0047

Secureworks

IRON TILDEN

UNATTRIBUTED ALIASESBlueAlphaACTINIUMUAC-0010WINTERFLOUNDERShuckwormTrident UrsaDEV-0157Armageddon

Victimology

Geographic footprint · 5 countries

origin · Russiatargeted countries · 5

EUROPE · 5

Lithuania · Latvia · Moldova · Poland · Ukraine

Sectors targeted

4 of 40

Government100 actors Defense72 actors Education & Research62 actors Legal & Professional18 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ESP · Espionage

MITRE ATT&CK · 56 techniques

Resource Development · 2

T1583.003Virtual Private Server T1583.006Web Services

Initial Access · 1

T1566.001Spearphishing Attachment

Execution · 7

T1047Windows Management Instrumentation

Persistence · 2

T1137Office Application Startup

Discovery · 5

T1012Query Registry T1033System Owner/User Discovery

Lateral Movement · 4

T1021.005VNC

Collection · 5

T1005Data from Local System T1025Data from Removable Media T1039Data from Network Shared Drive T1113Screen Capture

Exfiltration · 2

T1020Automated Exfiltration T1041Exfiltration Over C2 Channel

Impact · 1

T1561.001Disk Content Wipe

Command And Control · 11

T1001Data Obfuscation T1071.001Web Protocols T1090Proxy

Defense Impairment · 2

T1112Modify Registry

Stealth · 14

T1027Obfuscated Files or Information T1027.004

GIR coverage

0 / 480 requirements satisfied

Open matrix

No GIRs mapped yet for this actor.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer56 techniques · layer format 4.5

Related actors

By origin and actor type

T1053.005

Scheduled Task

T1059.001PowerShell

T1059.003Windows Command Shell

T1059.005Visual Basic

T1106Native API

T1204.001Malicious Link

T1547.001

Registry Run Keys / Startup Folder

T1057

Process Discovery

T1083File and Directory Discovery

T1120Peripheral Device Discovery

T1080

Taint Shared Content

T1091Replication Through Removable Media

T1534Internal Spearphishing

T1119

Automated Collection

T1090.003

Multi-hop Proxy

T1095Non-Application Layer Protocol

T1102Web Service

T1102.002Bidirectional Communication

T1102.003One-Way Communication

T1105Ingress Tool Transfer

T1568Dynamic Resolution

T1571Non-Standard Port

T1685

Disable or Modify Tools

Compile After Delivery

T1027.010Command Obfuscation

T1027.015Compression

T1036.005Match Legitimate Resource Name or Location

T1055Process Injection

T1070.004File Deletion

T1140Deobfuscate/Decode Files or Information

T1218.005Mshta

T1218.011Rundll32

T1221Template Injection

T1480Execution Guardrails

T1564.003Hidden Window

T1620Reflective Code Loading