Threat Investigation
Request a demo
State-sponsored

Gamaredon Group

Gamaredon Group is classified as state-sponsored.

Malware families
14
Origin
Russia
Also known as
13

Unit 42 threat researchers have recently observed a threat group distributing new, custom developed malware. We have labelled this threat group the Gamaredon Group and our research shows that the Gamaredon Group has been active since at least 2013. In the past, the Gamaredon Group has relied heavily on off-the-shelf tools. Our new research shows the Gamaredon Group have made a shift to custom-developed malware. We believe this shift indicates the Gamaredon Group have improved their technical capabilities.

The group's reported origin is Russia.

The group is associated with 14 malware families.

Also known as: ACTINIUM, DEV-0157, Blue Otso, BlueAlpha, G0047, IRON TILDEN, PRIMITIVE BEAR, Shuckworm, Trident Ursa, UAC-0010, Winterflounder, Aqua Blizzard, Actinium

Threat Intelligence

Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.