| Gamaredon Group | |
|---|---|
| 🔱 Regional focus emblem (illustrative) | |
| Also known as | Shuckworm · Armageddon · Primitive Bear · Trident Ursa · ACTINIUM · Iron Tilden |
| Formation | c. 2013 |
| Type | Advanced persistent threat (state-sponsored) |
| Purpose | Espionage, Information theft, Surveillance |
| Target Sectors | Government (Ukraine), Military, Law Enforcement |
| Alleged parent org. | FSB (Crimea-based Center 18) |
| Attribution confidence | High |
| Status | ● Highly Active |
| Notable tools | Pterodo, Giddome, UltraVNC, PowerShell scripts |
Gamaredon Group, also known as Shuckworm and Armageddon, is a prolific Russian state-sponsored threat actor focused almost exclusively on Ukrainian national security interests. Publicly attributed by the Security Service of Ukraine (SBU) to the FSB Office in the Republic of Crimea and the City of Sevastopol, the group has been active since the 2013 annexation of Crimea.[1]
Unlike Turla or APT28, Gamaredon is characterized by a “quantity over quality” approach. They utilize high-volume phishing campaigns and rapidly iterated, relatively low-sophistication malware to maintain a constant presence in Ukrainian government and military networks.[2]
Shuckworm (Symantec) · Armageddon (SBU/Ukraine) · Primitive Bear (CrowdStrike) · Trident Ursa (Unit 42) · ACTINIUM (Microsoft) · Iron Tilden (Secureworks)
Overview
Gamaredon serves as a tactical cyber-espionage unit for the FSB, prioritizing the theft of military plans, diplomatic communications, and law enforcement data. They are known for their extreme persistence; if one of their implants is discovered and removed, they often attempt to re-infect the same target within hours using slightly modified payloads.[1]
Attribution
In November 2021, the Security Service of Ukraine (SBU) formally identified five members of the group, linking them directly to the FSB’s “Center 18” in Crimea. Technical analysis of their C2 infrastructure and phishing lures consistently aligns with Russian geopolitical interests in the Donbas and Crimean regions.[3]
Targets and Geopolitics
- Ukrainian Armed Forces — Operational data and troop movements.
- Government Agencies — Ministries, regional administrations, and emergency services.
- Humanitarian Organizations — NGOs operating within conflict zones in Ukraine.
Operational History
| Period | Key Activity |
|---|---|
| 2013–2014 | Initial formation during the Euromaidan protests and Crimea annexation. |
| 2017–2021 | Massive expansion of phishing infrastructure; daily targeting of Ukrainian officials. |
| 2022–Present | Active support of the Russian invasion through persistent tactical espionage and data theft. |
Toolset and Malware
The group relies heavily on custom scripts (VBScript, PowerShell) and open-source tools, which allows them to bypass traditional antivirus through constant minor variations in code.
| Name | Function |
|---|---|
| Pterodo (Pteranodon) | A modular backdoor used for reconnaissance and secondary payload delivery. |
| Giddome | A custom backdoor with data exfiltration and credential theft capabilities. |
| UltraVNC | Open-source remote access software used to manually control infected machines. |
| Telekopye | Telegram-based bots used for automated data exfiltration. |
Tactics and Procedures
| Tactic | Technique | Details |
|---|---|---|
| Initial Access | Phishing | Documents referencing military orders or regional conflict updates. |
| Execution | Macros | Heavy use of malicious VBA macros in .docx and .template files. |
| Persistence | Scheduled Tasks | Setting scripts to run every few minutes to ensure connection to C2. |
| C2 | Dynamic DNS | Frequent use of No-IP and other DDNS services to mask infrastructure. |
References
- Security Service of Ukraine (SBU), “Identification of FSB Officers in Crimea” (2021).
- Unit 42 by Palo Alto Networks, “Trident Ursa: The Most Active APT Targeting Ukraine” (2022).
- Symantec Enterprise, “Shuckworm: Continual Attacks on Ukraine” (2023).
- Microsoft Threat Intelligence Center (MSTIC), “ACTINIUM: Targetting Ukrainian Organizations” (2022).