Gamaredon, also known as Primitive Bear and Actinium (by Microsoft) is a Russian
advanced persistent threat that has been active since at least 2013.
Motivation
Cyber espionage appears to be the main goal of the group,[) and appears to provide services for other APTs.]
Tactics
The group frequently uses spear phishing
Phishing is a type of Social engineering (security), social engineering where an attacker sends a fraudulent (e.g., spoofed, fake, or otherwise deceptive) message designed to trick a person into revealing sensitive information to the attacker ...
techniques with malicious code attachments that download remote templates containing malware.[
Malware used by the group includes Pterodo, PowerPunch, ObfuMerry, ObfuBerry, DilongTrash, DinoTrain, and DesertDown.]
Ukraine
On 19 January 2022, they attempted to compromise a Western government entity in Ukraine.
See also
*Cyberwarfare by Russia
Cyberwarfare by Russia includes denial of service attacks, hacker attacks, dissemination of disinformation and propaganda, participation of state-sponsored teams in political blogs, internet surveillance using SORM technology, persecution of c ...
*Russian–Ukrainian cyberwarfare
Cyberwarfare is a component of the confrontation between Russia and Ukraine since the collapse of the Soviet Union in 1991. While the first attacks on information systems of private enterprises and state institutions of Ukraine were recorded durin ...
References
{{reflist
Hacking in the 2010s
Hacking in the 2020s
Russian advanced persistent threat groups