OldGremlin

Profile narrative

OldGremlin is a threat actor known by that alias and has been publicly linked to operations originating from Russia. The actor first appeared in open‑source reporting in connection with a cyber incident affecting the Russian e‑commerce platform Wildberries in March 2022. No further public identifiers or organizational affiliations have been attributed to OldGremlin beyond this single referenced incident.

On 2022‑03‑14, Wildberries experienced a widespread disruption that prevented users from logging in, tracking orders, and viewing purchase histories, while sellers lost access to dashboards, inventory systems, and shipment processing tools. The company initially described the outage as a technical fault but later acknowledged a medium‑scale cyber intrusion that partially disabled its services without compromising user financial data. Early speculation in media reports suggested that the intrusion might have been carried out by the foreign group OldGremlin using ransomware or insider assistance, although the company never confirmed the use of ransomware or identified any specific malware. Service restoration proceeded unevenly, with core functions largely returning for Russian users while some order visibility and partner interface issues persisted, and the platform extended storage deadlines and waived seller penalties during the recovery period.

Publicly available sources do not provide concrete details about OldGremlin’s typical targets, preferred sectors, or strategic objectives, nor do they describe specific malware families, initial‑access vectors, or tooling styles that have been definitively linked to the actor. The only technical detail mentioned in relation to OldGremlin is the unverified claim of ransomware use in the Wildberries case, which remains speculative and unconfirmed by the victim or independent investigators. Consequently, the profile of OldGremlin is limited to the alias, its presumed Russian origin, and the single publicly reported incident involving Wildberries.

Incidents

Attributed incidents are available to members.