Gamaredon
Attribution profile
- Type
- Nation State
- Location
- Russia
- Known incidents
- 1 incident
- Sources
- 4 sources
- First seen
- 2019-11-25
- Last seen
- 2019-11-25
- Updated
- 2026-10-11 04:22
- Aliases
- 3 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Gamaredon, also known as Primitive Bear and UAC-0046, is a Russia-linked threat actor attributed to the Russian military. It primarily targets Ukrainian government entities, including the Ministry of Foreign Affairs, military and security institutions, diplomats, law‑enforcement personnel, NGOs and journalists, with the objective of cyber‑espionage and, in some cases, disruption of physical infrastructure such as artillery systems. The group’s typical TTPs involve spear‑phishing with weaponized documents that use template injection to download a malicious .dot file; the embedded VBA macro writes a VBScript to the startup folder which, after a sleep period, performs an HTTP GET to a dynamic‑DNS domain to retrieve an encrypted second‑stage payload only if the victim is deemed of interest. Gamaredon also employs self‑extracting archives (.SFX) containing batch scripts, .NET components and macro payloads, often leveraging the Microsoft.Vbe.Interop library, obfuscated .NET Excel/Word macro execution, fake Microsoft Time‑Stamp Service certificates and Nginx forwarders to relay traffic. Its malware repertoire includes the Pterodo/Pteranodon backdoor, which gathers system data via systeminfo.exe, uploads it to command‑and‑control servers and can download additional tools such as a wget‑based utility. Publicly reported operations include a September‑November 2019 campaign against Ukrainian governmental bodies, a mid‑October to November 2019 wave targeting diplomats and officials, and an April 2019 lure posing as a “State of the Armed Forces of Ukraine” document aimed at military personnel.
Incidents
Attributed incidents are available to members.
1 incidentSources
Sources available to members: 4 sources.