Quick links
Press Enter to search, Esc to close
Threat group profile
Attributed by Ukraine's Security Service (SSU, 2021) to Russia's FSB, and described by MITRE ATT&CK as a suspected Russian group that has targeted Ukrainian organizations since at least 2013.
In short
Attributed by Ukraine's Security Service (SSU, 2021) to Russia's FSB, and described by MITRE ATT&CK as a suspected Russian group that has targeted Ukrainian organizations since at least 2013. It mostly gets in through emails with Office files or archives, and a Ukrainian court convicted two members in absentia on 8 October 2024.
Public reports use several names for this activity.
| Name | Where it appears |
|---|---|
| Gamaredon Group | MITRE ATT&CK G0047 (group name)[1] |
| IRON TILDEN | MITRE ATT&CK Associated Groups[1] |
| Primitive Bear | MITRE ATT&CK Associated Groups; Estonian RIA threat note of 11 February 2022[1, 16] |
| ACTINIUM | MITRE ATT&CK Associated Groups; Estonian RIA threat note (as Actinium)[1, 16] |
| Armageddon | MITRE ATT&CK Associated Groups; SSU technical report; Canadian Cyber Centre bulletin; CERT-UA reports[1, 4, 11, 8] |
| ARMAGEDON | SSU press release of 4 November 2021 (the SSU's own spelling)[2] |
| Shuckworm | MITRE ATT&CK Associated Groups; Canadian Cyber Centre bulletin[1, 11] |
| DEV-0157 | MITRE ATT&CK Associated Groups[1] |
| Aqua Blizzard | MITRE ATT&CK Associated Groups[1] |
| NastyShrew | MITRE ATT&CK Associated Groups[1] |
| UAC-0010 | CERT-UA reports (its own tracking number for the group)[8, 9] |
| Winterflouder | SSU technical report (spelling as printed there)[4] |
| BlueAlpha | SSU technical report[4] |
| BlueOtso | SSU technical report[4] |
| IronTiden | SSU technical report (spelling as printed there)[4] |
| SectorC08 | SSU technical report[4] |
| Callisto | SSU technical report (a common word; check the context before linking it to this group)[4] |
Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.
MITRE ATT&CK Page version 3.3, last modified 31 July 2026
Describes a suspected Russian cyber espionage group active against Ukrainian organizations since at least 2013, and records that the Ukrainian government attributed it to FSB Center 18 in November 2021.[1]
Security Service of Ukraine (SSU) 4 November 2021
Said the group it calls ARMAGEDON is an FSB special project coordinated by the FSB's 18th Center in Moscow, with members who are officers of the "Crimean" FSB. Five members were notified of suspicion of treason.[2, 3]
SSU technical report 2021
Said it "unambiguously identifies" Armageddon as a specially created unit of the FSB and as part of the FSB office for Crimea and Sevastopol.[4]
Estonian Information System Authority (CERT-EE) 11 February 2022
Described Gamaredon as an APT linked to the Russian special service.[16]
Canadian Cyber Centre June 2022
Reported that security firms attributed April 2022 attacks to Armageddon (Gamaredon, Shuckworm), which it said has been linked to the FSB.[11]
CERT-UA (Ukraine) July 2023
Said UAC-0010 (Armageddon) is run by former SSU officers from Crimea who turned to serve the FSB.[8]
National Security and Defense Council of Ukraine 2023
Said SSU investigations in 2021 linked the group to the FSB directorate in Crimea.[10]
SSU 12 September 2023
Said it served suspicion notices to 8 members, sent indictments for 4 to court, and that the NSDC put 5-year sanctions on eight members in 2022.[5]
SSU and Prosecutor General's Office 8 October 2024
Reported that a court convicted two former SSU Crimea officers, now FSB staff, of treason and unauthorized interference, 15 years each, in absentia.[6, 7]
CERT-EU 1 October 2025
Refers to Gamaredon and Turla as "Russian FSB-linked groups" in its September 2025 brief.[13]
Sources differ on how sure they are. MITRE ATT&CK calls Gamaredon a suspected Russian group and records Ukraine's November 2021 attribution to FSB Center 18. The SSU states it without hedging and says the unit sits inside the FSB office for Crimea and Sevastopol, coordinated by the 18th Center in Moscow. The Canadian Cyber Centre only says the group "has been linked to" the FSB.
Sources differ on the start. MITRE says at least 2013. The SSU report says 2014, with some sources pointing to June 2013. The NSDC report says around 2013. The Ukrainian court finding covers March 2014 to March 2021.
The number of people differs by date, not by dispute. The SSU gave 5 members notified of suspicion in November 2021, 8 notified and 4 indicted by September 2023, and 2 convicted in October 2024. No source opened gives their names.
Each entry is attributed to the group by the sources cited.
The Prosecutor General's Office says the court found the group carried out cyber espionage and attacks in this period.[7]
The SSU says Pterodo became the group's main tool from 2016.[4]
The Prosecutor General's Office says the convicted pair and others attacked critical information infrastructure in this period.[7]
The SSU said it identified the people behind ARMAGEDON, an FSB project coordinated by the 18th Center, and notified 5 members of suspicion of treason.[2]
The Estonian Information System Authority named Gamaredon among phishing threats linked to the Russian special service.[16]
CERT-UA found archives posing as military aid lists, one sent to a Latvian state body.[9]
The Canadian Cyber Centre reported four variants of a new malware aimed at Ukrainian targets, attributed by security firms to Armageddon.[11]
CERT-UA says emails with HTM droppers started the GammaLoad chain, and Word templates were modified to spread the infection.[17]
CERT-UA recorded mass emails with a malicious link from 7 November 2022 and linked the activity to UAC-0010.[18]
The NSDC report says the group registered a large number of domains before the Ukrainian counteroffensive.[10]
CERT-UA called UAC-0010 one of the most persistent cyber threats and said files can be stolen within 30 to 50 minutes of infection.[8]
CERT-EU reported an attack on a Western military mission in Ukraine through infected removable drives.[12]
CERT-EU reported what it called the first known collaboration between Gamaredon and Turla.[13]
Indictments, sanctions and advisories that name the group or its alleged members.
| Date | Who | What |
|---|---|---|
| 4 November 2021 | Security Service of Ukraine (SSU) | Notices of suspicion and public namingNotified 5 members of suspicion of treason (Article 111 of the Criminal Code) and opened inquiries into espionage, unauthorized interference with computers and creating malware. The SSU said the unit was an FSB special project coordinated by the 18th Center.[2, 3] |
| 2021 | Security Service of Ukraine (SSU) | Technical reportPublished a technical report on Armageddon with eight recommendations.[4] |
| 11 February 2022 | Estonian Information System Authority (CERT-EE) | Threat noteNamed Gamaredon among Ukraine-related phishing threats and advised Estonian organizations to review their security measures.[16] |
| 2022 | National Security and Defense Council (NSDC) of Ukraine | SanctionsA decision imposing 5-year sanctions on eight members of the group came into force, as the SSU describes it in September 2023.[5] |
| April 2022 | CERT-UA | AlertReported lures that point to attacks on EU state bodies, with indicators of compromise.[9] |
| June 2022 | Canadian Cyber Centre | Threat bulletinReported four new malware variants against Ukraine linked to Armageddon.[11] |
| 2023 | NSDC of Ukraine | ReportPublished a strategic report on Gamaredon activity during the counteroffensive.[10] |
| July 2023 | CERT-UA | Summary reportSummarized the group's methods and said the most effective measure is to restrict mshta.exe, wscript.exe, cscript.exe and powershell.exe.[8] |
| 12 September 2023 | SSU and State Bureau of Investigation | IndictmentSent to court an indictment for high treason against a former SSU officer now serving in the FSB, said to have worked with the Armageddon hackers. The SSU said suspicion notices went to 8 members and indictments for 4.[5] |
| 8 October 2024 | Court in Ukraine, on SSU and Prosecutor General evidence | Conviction in absentiaTwo former SSU Crimea officers, now FSB staff, were sentenced to 15 years each for high treason (Article 111 part 1) and unauthorized interference (Article 361 part 2).[6, 7] |
| 3 April 2025 | CISA, NSA, FBI, ASD's ACSC, Canadian Cyber Centre, NCSC-NZ | Joint advisoryNamed Gamaredon as a user of fast flux and set out ways to block it.[14] |
Techniques reported for this group, by MITRE ATT&CK tactic.
Pteranodon Backdoor
MITRE calls it a custom backdoor used by the group. The SSU, which calls it Pterodo, says it has been the main tool since 2016.[21, 4]
PowerPunch Downloader
MITRE describes a lightweight downloader used by the group since at least 2021.[22]
QuietSieve Information stealer
MITRE describes an information stealer used by the group since at least 2021.[23]
GammaLoad Loader
CERT-UA and the NSDC name it as the first stage after a phishing file is opened.[17, 10]
GammaSteel File stealer
CERT-UA names it as the tool that steals documents and browser credentials; CERT-EU names it in the 2025 military mission attack.[17, 8, 12]
UltraVNC Remote access tool
MITRE lists the group using VNC tools including UltraVNC, and the SSU names UltraVNC among its remote access tools.[1, 4]
Remcos Remote access tool
MITRE lists the group using Remcos, a commercial remote control tool.[24, 1]
Block known fast flux domains, log and monitor DNS traffic, and check that your protective DNS service covers fast flux, as the April 2025 joint advisory says.
Counters T1568.001
Spot look-alike domains and phishing sites that imitate your organization or its partners, which this group's fake official letters rely on.
Follow reporting from governments on this group's tools, entry methods and infrastructure and turn it into checks for your own team.
See which mail, remote access and web services of yours are open to the internet so that gaps are closed before attackers use them.
Bring alerts about your domains, exposed services and threat reports into one place so a small team can act on them.
MITRE ATT&CK describes it as a suspected Russian cyber espionage group that has targeted Ukrainian military, law enforcement, judiciary and non-profit organizations since at least 2013. The Ukrainian government attributes it to the FSB, Russia's domestic security service.
The SSU said on 4 November 2021 that the group it calls ARMAGEDON is an FSB project coordinated by the FSB's 18th Center. MITRE records this attribution. The Canadian Cyber Centre reported in June 2022 that the group has been linked to the FSB.
Only in Ukraine, per the SSU and the Prosecutor General. Five members were notified of suspicion in 2021, eight by 2023, and two former SSU Crimea officers were convicted in absentia on 8 October 2024 and sentenced to 15 years each. No source opened gives names.
Mostly by email. The SSU says malicious attachments sent as official letters remain the main route. CERT-UA says an archive holding an HTM or HTA file is the common route now, and that messaging apps and hijacked accounts are also used. CERT-EU reported infected USB drives in 2025.
The SSU says the group does not try hard to stay hidden and repeats mass mailings to the same people. CERT-UA says it can steal files within 30 to 50 minutes of infection, and the NSDC says it hides server addresses in Cloudflare DNS and Telegram.
Stop Office programs from starting scripts or reaching the internet, block mshta.exe, wscript.exe, cscript.exe and powershell.exe for ordinary users, and restrict USB drives.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.