AdversaryGraph public intelligence page

This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.

Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.

Main AdversaryGraph project Documentation Malware Analysis GitHub

G0047 · 55 ATT&CK techniques · 0 correlated reports

Gamaredon Group

Aliases: IRON TILDEN, Primitive Bear, ACTINIUM, Armageddon, Shuckworm, DEV-0157, Aqua Blizzard

Gamaredon Group is a suspected Russian cyber espionage threat group that has targeted military, NGO, judiciary, law enforcement, and non-profit organizations in Ukraine since at least 2013. The name Gamaredon Group comes from a misspelling of the word "Armageddon", which was detected in the adversary's early campaigns. In November 2021, the Ukrainian government publicly attributed Gamaredon Group to Russia's Federal Security Service (FSB) Center 18.

Open interactive actor investigation

ATT&CK techniques

T1491.001
Internal Defacement T1583.003
Virtual Private Server T1001
Data Obfuscation T1534
Internal Spearphishing T1047
Windows Management Instrumentation T1083
File and Directory Discovery T1119
Automated Collection T1036.005
Match Legitimate Name or Location T1027.004
Compile After Delivery T1105
Ingress Tool Transfer T1021.005
VNC T1027.001
Binary Padding T1218.011
Rundll32 T1566.001
Spearphishing Attachment T1082
System Information Discovery T1059.005
Visual Basic T1113
Screen Capture T1005
Data from Local System T1039
Data from Network Shared Drive T1608.001
Upload Malware T1102.003
One-Way Communication T1112
Modify Registry T1016.001
Internet Connection Discovery T1559.001
Component Object Model T1562.001
Disable or Modify Tools T1025
Data from Removable Media T1221
Template Injection T1140
Deobfuscate/Decode Files or Information T1204.001
Malicious Link T1080
Taint Shared Content T1106
Native API T1561.001
Disk Content Wipe T1033
System Owner/User Discovery T1564.003
Hidden Window T1070.004
File Deletion T1059.001
PowerShell T1588.002
Tool T1020
Automated Exfiltration T1071.001
Web Protocols T1583.001
Domains T1568.001
Fast Flux DNS T1120
Peripheral Device Discovery T1041
Exfiltration Over C2 Channel T1053.005
Scheduled Task T1027
Obfuscated Files or Information T1057
Process Discovery T1027.010
Command Obfuscation T1204.002
Malicious File T1568
Dynamic Resolution T1547.001
Registry Run Keys / Startup Folder T1480
Execution Guardrails T1059.003
Windows Command Shell T1218.005
Mshta T1137
Office Application Startup T1102
Web Service

Correlated CTI and IR reports

Continue the investigation

Interactive AdversaryGraph AdversaryGraph documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas Insider Threat Detection Guide 1200km Medium research