February 20, 2024
Technical and contextual characteristics of the Lazarus Group are analysed in this APT Profile from the EuRepoC team.
APT Profile – Gamaredon
Russian Intelligence Preparation of the Battlefield in Ukraine
- 23 January 2023
- Zettl-Schabath, Kerstin; Bund, Jakob; Rottinger, Lena; Borrett, Camille
- EN
About Gamaredon
Gamaredon is a state-integrated hacking group (intelligence service/agency members). Government and industry reporting has identified Gamaredon as Russia-nexus agent that operates in close alignment with Russian state interests in Ukraine. Ukraine’s main intelligence agency SSU explicitly linked the group to the FSB, personally identifying five members known to be officers of Russia’s security service.
Associated APT designations
- Gamaredon Group (LookingGlass, ESET)
- ACTINIUM/ DEV-0157 (Microsoft)
- BlueAlpha (Recorded Future)
- Dancing Salome (Kaspersky)
- G0047 (MITRE ATT&CK)
- Iron Tilden (Secureworks)
- Primitive Bear (CrowdStrike)
- Shuckworm (Symantec)
- Trident Ursa (UNIT 42/Palo Alto)
- UAC-0010 (CERT-UA)
- Winterflouder (iDefence)
Country of origin
Period of activity
June 2013-today
Industry reporting traces the group’s operations back to June 2013, only months before the Russian annexation of the Crimean Peninsula.
More APT profiles
- Research and Analysis
September 26, 2023
Technical and contextual characteristics of the APT3 group are analysed in this APT Profile from the EuRepoC team.
May 25, 2023
Technical and contextual characteristics of the UNC1151 group are analysed in this APT Profile from the EuRepoC team