Gamaredon Group G0047

Overview 62,980 indicators

Gamaredon Group is a suspected Russian cyber espionage group that has targeted military, law enforcement, judiciary, non-profit, and non-governmental organizations in Ukraine since at least 2013. The name Gamaredon Group derives from a misspelling of the word "Armageddon," found in early campaigns. In November 2021, the Ukrainian government publicly attributed Gamaredon Group to Russia’s Federal Security Service (FSB) Center 18, an assessment later supported by multiple independent cybersecurity researchers.

Techniques 70 ATT&CK

Open in ATT&CK Navigator → or download the layer (70 techniques, layer 4.5)

• T1001 Data Obfuscation
• T1005 Data from Local System
• T1012 Query Registry
• T1016.001 Internet Connection Discovery
• T1020 Automated Exfiltration
• T1021.005 VNC
• T1025 Data from Removable Media
• T1027 Obfuscated Files or Information
• T1027.004 Compile After Delivery
• T1027.010 Command Obfuscation
• T1027.012 LNK Icon Smuggling
• T1027.015 Compression
• T1027.016 Junk Code Insertion
• T1033 System Owner/User Discovery
• T1036.005 Match Legitimate Resource Name or Location
• T1039 Data from Network Shared Drive
• T1041 Exfiltration Over C2 Channel
• T1047 Windows Management Instrumentation
• T1053.005 Scheduled Task
• T1055 Process Injection
• T1057 Process Discovery
• T1059.001 PowerShell
• T1059.003 Windows Command Shell
• T1059.005 Visual Basic
• T1070.004 File Deletion
• T1071.001 Web Protocols
• T1080 Taint Shared Content
• T1082 System Information Discovery
• T1083 File and Directory Discovery
• T1090 Proxy
• T1090.003 Multi-hop Proxy
• T1091 Replication Through Removable Media
• T1095 Non-Application Layer Protocol
• T1102 Web Service
• T1102.002 Bidirectional Communication
• T1102.003 One-Way Communication
• T1105 Ingress Tool Transfer
• T1106 Native API
• T1112 Modify Registry
• T1113 Screen Capture
• T1119 Automated Collection
• T1120 Peripheral Device Discovery
• T1137 Office Application Startup
• T1140 Deobfuscate/Decode Files or Information
• T1204.001 Malicious Link
• T1204.002 Malicious File
• T1218.005 Mshta
• T1218.011 Rundll32
• T1221 Template Injection
• T1480 Execution Guardrails
• T1491.001 Internal Defacement
• T1497.001 System Checks
• T1518.001 Security Software Discovery
• T1534 Internal Spearphishing
• T1547.001 Registry Run Keys / Startup Folder
• T1559.001 Component Object Model
• T1561.001 Disk Content Wipe
• T1564.003 Hidden Window
• T1566.001 Spearphishing Attachment
• T1568 Dynamic Resolution
• T1568.001 Fast Flux DNS
• T1571 Non-Standard Port
• T1583.001 Domains
• T1583.003 Virtual Private Server
• T1583.006 Web Services
• T1587.003 Digital Certificates
• T1588.002 Tool
• T1608.001 Upload Malware
• T1620 Reflective Code Loading
• T1685 Disable or Modify Tools

Software 6

• Reg
• Ping
• Pteranodon
• Remcos
• PowerPunch
• QuietSieve

Principal sources 3,058 reports

Ranked by how many of this actor's indicators each report brought in.

• 13,258virustotal.com/gui/ip-address/170.64.146.248/relations
• 10,887virustotal.com/gui/ip-address/165.22.16.41/relations
• 2,277virustotal.com/gui/ip-address/139.180.168.138/relations
• 1,601virustotal.com/gui/ip-address/159.223.236.108/relations
• 1,303virustotal.com/gui/ip-address/78.141.206.197/relations
• 1,114virustotal.com/gui/ip-address/162.33.178.84/relations
• 1,060virustotal.com/gui/ip-address/45.76.36.201/relations
• 1,053virustotal.com/gui/ip-address/45.61.136.56/relations

Related groups 4

What the sources have in common — not a claim that these are the same actor. See the whole graph.

• Inception G0100
  1 shared indicator
• TINYSCOUTS
  1 shared indicator · 2 reports cite both
• APT41 G0096
  1 report cite both
• Kimsuky G0094
  1 report cite both

Timeline 62,980 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

Showing the 300 most recent of 62,980. Complete: G0047.json.

No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.

1. 2026-06-25 33 domain, 1 urlthis year

   x.com/blackorbird/status/2070111342934233218 · github.com/blackorbird/APT_REPORT/blob/master/Gama…

   domain	3742eddi.workers.dev
   domain	7062a41689f7a.loophole.site
   domain	7tnzsgp4-80.use.devtunnels.ms
   domain	ac7d30a02442d.loophole.site
   domain	alfred-assumptionsasin-winston.trycloudflare.com
   domain	cheese-metalsgourmet-interviews.trycloudflare.com
   domain	dushun.ru
   domain	earlysilence.ru
   domain	fewwef.workers.dev
   domain	finally-electionaudience-dont.trycloudflare.com
   domain	graph-proved-physicians-ward.trycloudflare.com
   domain	holdmyspice.ru
   domain	ignores.workers.dev
   domain	innocent-faressupposedloved.trycloudflare.com
   domain	jvyuwatt.ssuworker.workers.dev
   domain	lettinggo.ru
   domain	maybefallout.online
   domain	maybefallout.ru
   domain	parameter-iron-turns-combinations.trycloudflare.com
   domain	ser-uk-definesinvolved.trycloudflare.com
   domain	srkwk.3742eddi.workers.dev
   domain	ssuworker.workers.dev
   domain	stake.ytmrj83283.workers.dev
   domain	szrtrboyre.fewwef.workers.dev
   domain	utulex.ru
   domain	veryinappropriate.ru
   domain	wage.zpwyi71185.workers.dev
   domain	wwpeeya.ignores.workers.dev
   domain	x3f2q1cd80.asse.devtunnels.ms
   domain	your-combinationpercent-gibson.trycloudflare.com
   domain	ytmrj83283.workers.dev
   domain	zalupka.net
   domain	zpwyi71185.workers.dev
   url	http://69.67.173.214

   copy batch

2. 2026-06-08 1 domain, 1 ipv4, 1 urlthis year

   blog.sekoia.io/fsbs-matryoshka-3-3-gamaredons-gifts-th…

   domain	justsstop.ru
   ipv4	165.22.170.129:443
   url	http://165.22.170.129

   copy batch

3. 2026-06-03 10 domain, 1 urlthis year

   blog.sekoia.io/fsbs-matryoshka-2-3-gamaredons-gifts-th…

   domain	2j.dayobtvoyu.ru
   domain	csxvl00328.workers.dev
   domain	dayobtvoyu.ru
   domain	e097.yggjf81487.workers.dev
   domain	febul89300.workers.dev
   domain	insight-sweet-drainage-appreciated.trycloudflare.com
   domain	sweet.csxvl00328.workers.dev
   domain	vids-road-christina-guards.trycloudflare.com
   domain	white.febul89300.workers.dev
   domain	yggjf81487.workers.dev
   url	http://172.86.72.243

   copy batch

4. 2026-06-02 3 domainthis year

   blog.sekoia.io/fsbs-matryoshka-1-3-gamaredons-gifts-th…

   bold.zsjtn41091.workers.dev

   quitethepastry.ru

   zsjtn41091.workers.dev

   copy batch

5. 2026-05-16 1 domain, 1 ipv4this year

   x.com/smica83/status/2054882140169363928 · x.com/smica83/status/2055647354485690522 · virustotal.com/gui/file/836db26f88b8124828629f1bcf5e12… · virustotal.com/gui/file/ccbe75cdcf65ee66e44c09e33d99a2… · virustotal.com/gui/file/0ac035b3695c933dda913b1a0037d4…

   domain	advocat.publicvm.com
   ipv4	89.124.88.211:443

   copy batch

6. 2026-05-14 1 domain, 1 ipv4this year

   x.com/smica83/status/2054882140169363928 · x.com/smica83/status/2055647354485690522 · virustotal.com/gui/file/836db26f88b8124828629f1bcf5e12… · virustotal.com/gui/file/ccbe75cdcf65ee66e44c09e33d99a2… · virustotal.com/gui/file/0ac035b3695c933dda913b1a0037d4…

   domain	advokat.publicvm.com
   ipv4	89.124.79.33:8080

   copy batch

7. 2026-05-13 129 domain, 1 ipv4, 9 url_paththis year

   harfanglab.io/insidethelab/gamaredon-gammadrop-gammal… · virustotal.com/gui/file/245a3b5790ff9bc88a9133d4e03f4f… · virustotal.com/gui/file/62818ae5e305b89b9461536dac1b9d… · virustotal.com/gui/file/ef239b58b6bae3034b66274ca5d377… · virustotal.com/gui/file/9a7053ce9d9959619f35ee58c0dcaf… · virustotal.com/gui/file/be05c74c5ed62be987bbd868c51ab8… · virustotal.com/gui/file/7b9582b2a84f0c61d51246896ae4f0…

   domain	2ad1.gmuds90318.workers.dev
   domain	2f34.u9wixg8dcxrxw.workers.dev
   domain	300a.mbdudar2m.workers.dev
   domain	33.soprorotos.ru
   domain	46c0.sqogj22317.workers.dev
   domain	47ad.pdjqa15890.workers.dev
   domain	6cab.pxlbg77972.workers.dev
   domain	6u.uarefire.online
   domain	7799.nlufx08035.workers.dev
   domain	a.cnbyvilkghx2a6p.workers.dev
   domain	ab0f2.xh0lr6gvbtqopyp.workers.dev
   domain	alazsol.ru
   domain	antresolle.online
   domain	antresolle.ru
   domain	armanzo.ru
   domain	asc67.viperan.ru
   domain	astrocaf.com
   domain	b80.sc9nj1tx.workers.dev
   domain	bf7.he2p9djjz.workers.dev
   domain	biillingr.scdevelopements.com
   domain	billonda.ru
   domain	bittere63e.gcjc7ulfg8zc.workers.dev
   domain	bloodywolves.ddns.net
   domain	bnxaz24270.workers.dev
   domain	boppekax.ru
   domain	broken-dust-20eb.bnxaz24270.workers.dev
   domain	busha80d.dp7uszdstai.workers.dev
   domain	bzcku21528.workers.dev
   domain	bzvbl72942.workers.dev
   domain	c71.zb41e6kcfa.workers.dev
   domain	cf2.tcrn7uoroffxls.workers.dev
   domain	cloud-stetament-online.ddnsfree.com
   domain	cnbyvilkghx2a6p.workers.dev
   domain	daremoinai.bounceme.net
   domain	db6b.vmocs87616.workers.dev
   domain	dmnfesfnadt3.workers.dev
   domain	dnco.site
   domain	dp7uszdstai.workers.dev
   domain	eldior.ru
   domain	elvaos.ru
   domain	f6f8.bzvbl72942.workers.dev
   domain	fallze2e73.l1uxclprg1cj.workers.dev
   domain	favoriteclown.endl.site
   domain	ffoqdlqg.workers.dev
   domain	gcjc7ulfg8zc.workers.dev
   domain	gmuds90318.workers.dev
   domain	gusnqojic0byx.workers.dev
   domain	h4puonhajw.workers.dev
   domain	hatf8d7.oxwqplxmoyjpe.workers.dev
   domain	he2p9djjz.workers.dev
   domain	heart7766.vmkyieebw2.workers.dev
   domain	iguessillgoout.myvnc.com
   domain	j2.scdevelopements.com
   domain	jiri.eldior.ru
   domain	ke3fm3xwqbhi.workers.dev
   domain	kosoyed.online
   domain	kosoyed.ru
   domain	kw68guncvjq.workers.dev
   domain	l1uxclprg1cj.workers.dev
   domain	li751.ffoqdlqg.workers.dev
   domain	lin95.lp6kxqip.workers.dev
   domain	lively-disk-b5d5.tiffany88-140.workers.dev
   domain	lp6kxqip.workers.dev
   domain	mail.astrocaf.com
   domain	massadex.3utilities.com
   domain	mbdudar2m.workers.dev
   domain	mnf8b.wcpxlxtnk.workers.dev
   domain	mo88.dmnfesfnadt3.workers.dev
   domain	msc-chek.ru
   domain	neddos.ru
   domain	nlufx08035.workers.dev
   domain	ns2.kosoyed.ru
   domain	nsdbzy1t.workers.dev
   domain	oclouds.ru
   domain	oreb1.qxjmxpd8dfr.workers.dev
   domain	oxwqplxmoyjpe.workers.dev
   domain	pati1fa.gusnqojic0byx.workers.dev
   domain	pdjqa15890.workers.dev
   domain	pe.neddos.ru
   domain	pg.eldior.ru
   domain	pr.elvaos.ru
   domain	pxlbg77972.workers.dev
   domain	q9.zelzer.ru
   domain	qu776.nsdbzy1t.workers.dev
   domain	qxjmxpd8dfr.workers.dev
   domain	raspy.bzcku21528.workers.dev
   domain	relay.astrocaf.com
   domain	rfgah07ggr.workers.dev
   domain	rubakovox.pro
   domain	rug5o12yj2pa.workers.dev
   domain	sb353.rug5o12yj2pa.workers.dev
   domain	sc9nj1tx.workers.dev
   domain	scdevelopements.com
   domain	soprorotos.ru
   domain	sq.viperan.ru
   domain	sqogj22317.workers.dev
   domain	squc32.ke3fm3xwqbhi.workers.dev
   domain	sr.alazsol.ru
   domain	ss975.zsq7cmi9.workers.dev
   domain	st.armanzo.ru
   domain	sweetnce.kw68guncvjq.workers.dev
   domain	sz.kosoyed.ru
   domain	tcrn7uoroffxls.workers.dev
   domain	thre6d.rfgah07ggr.workers.dev
   domain	throbsuns2.h4puonhajw.workers.dev
   domain	tiffany88-140.workers.dev
   domain	tigh8d.wnsmohinpf.workers.dev
   domain	tillthesunrise.sytes.net
   domain	u9wixg8dcxrxw.workers.dev
   domain	uarefire.online
   domain	uarefire.ru
   domain	vaporblue.ddnsking.com
   domain	vc.uarefire.ru
   domain	viperan.ru
   domain	vj.boppekax.ru
   domain	vmkyieebw2.workers.dev
   domain	vmocs87616.workers.dev
   domain	wcpxlxtnk.workers.dev
   domain	wnsmohinpf.workers.dev
   domain	worker.3utilities.com
   domain	xh0lr6gvbtqopyp.workers.dev
   domain	youaresilent.online
   domain	youaresilent.ru
   domain	yourrain.online
   domain	yourrain.ru
   domain	zb41e6kcfa.workers.dev
   domain	zeh01.host2go.net
   domain	zelzer.ru
   domain	zsq7cmi9.workers.dev
   ipv4	107.189.25.145:8008
   url_path	/AkadHtm-28-04/
   url_path	/AkadHtm-28-04/aggregation/pea/
   url_path	/DvvsUa-18-03/
   url_path	/DvvsUa-18-03/knife/bennet/
   url_path	/GppUa-18-03/
   url_path	/GppUa-18-03/cane/athwart/
   url_path	/GppUa-18-03/disturb/mother/
   url_path	/MouBig-27-04/
   url_path	/MouBig-27-04/confer/

   copy batch

8. 2026-05-13 1 urlthis year

   tria.ge/251202-py8v3swjap/behavioral2 · virustotal.com/gui/file/28431f09c87116adacac29abcd6575… · virustotal.com/gui/file/bce49a781267db81ff9a070abd80c9… · virustotal.com/gui/file/6bae37356ac23bb2c17e8d6a62a18a…

   http://107.189.19.48

   copy batch

9. 2026-05-01 30 domainthis year

   virustotal.com/gui/ip-address/144.172.85.28/relations

   82resto.ru

   anatolina.ru

   as-prometheus.ru

   bashkirbees.ru

   bstrela.ru

   btc43.ru

   buketplus-dzr.ru

   chazirtest.ru

   creativelabo.ru

   dvincik.ru

   headlinerscrypto.ru

   hench.ru

   hostel-in.ru

   hrstories.ru

   innovatehub.ru

   leresume.ru

   mdeditor.ru

   milanaykus.ru

   monoplit.ru

   proekt-sew.ru

   purpurwhale.ru

   skopina.ru

   stoauto-primier.ru

   svd-123.ru

   udivitor.ru

   umco-01.ru

   vgik27.ru

   web-prov.ru

   wezar.ru

   zalipka.ru

   copy batch

10. 2026-03-10 1 url, 1 url_paththis year

    x.com/smica83/status/2031353310469386501 · virustotal.com/gui/file/edc242b4a81011d254cbad1b448cab…

    url	http://212.193.20.110
    url_path	/AkkUa-10-03

    copy batch

11. 2026-02-08 22 domainthis year

    x.com/Cyber0verload/status/2020257754020032661

    ansowhat.online

    avhcz36777.workers.dev

    dpbki57860.workers.dev

    drunk-bear.workers.dev

    fewfgwegf.workers.dev

    go0glee.workers.dev

    lgrpl85754.workers.dev

    moressa.online

    notathird.online

    npvcr24265.workers.dev

    oclouds.online

    pernicious.workers.dev

    perspicacious.ru

    pgffe70962-268.workers.dev

    pushing.perspicacious.ru

    rgrem29013.workers.dev

    rspqf54995.workers.dev

    tmwco85016.workers.dev

    warker.workers.dev

    wznye68531.workers.dev

    yahhoo.workers.dev

    yojyk05723.workers.dev

    copy batch

12. 2026-02-04 6 domainthis year

    x.com/smica83/status/2019029651260399710 · virustotal.com/gui/file/c759e9d24a0ab4ddd73317ffa466d9…

    awokent5.ease.workers.dev

    be42.khlgj68234.workers.dev

    ease.workers.dev

    inquiries.workers.dev

    khlgj68234.workers.dev

    mobx2i.inquiries.workers.dev

    copy batch

13. 2026-01-16 6 domainthis year

    virustotal.com/gui/ip-address/144.172.96.59/relations

    44getobject.vitorog.ru

    for2023.podriks.ru

    for364.podriks.ru

    for3836.podriks.ru

    then10.mitrala.ru

    then79.mitrala.ru

    copy batch

14. 2026-01-06 1 domainthis year

    virustotal.com/gui/ip-address/212.193.20.110/relations

    hampay.serveirc.com

    copy batch

15. 2026-01-02 or earlier 122 domain, 9 url, 2 url_paththis year

    security.com/threat-intelligence/shuckworm-ukraine-g… · virustotal.com/gui/ip-address/107.189.19.137/relations · virustotal.com/gui/ip-address/172.86.80.234/relations · virustotal.com/gui/ip-address/45.61.169.118/relations · virustotal.com/gui/file/7e129d0cc94ef8e15eb0303cb68800… · virustotal.com/gui/file/b694b7c89fdffa9945d291dc46c7c1… · virustotal.com/gui/file/30100e3f2f6d1dc04c366ad2e98bd3…

    domain	0aaqhwf689wwecsz.stradrol.ru
    domain	100asc.crudoes.ru
    domain	10chr.crudoes.ru
    domain	10to.crudoes.ru
    domain	16sleep.crudoes.ru
    domain	19loop.crudoes.ru
    domain	1zerrvhhqobcihry.drygmetal.ru
    domain	21position.crudoes.ru
    domain	24createobject.crudoes.ru
    domain	29absorbed.crudoes.ru
    domain	29send.crudoes.ru
    domain	2hazard.crudoes.ru
    domain	32function.crudoes.ru
    domain	35absorbed.crudoes.ru
    domain	35chr.crudoes.ru
    domain	36asc.crudoes.ru
    domain	3kppnqjsdkj.drygmetal.ru
    domain	40chr.crudoes.ru
    domain	40openastextstream.crudoes.ru
    domain	41savetofile.crudoes.ru
    domain	44journal.crudoes.ru
    domain	44loop.crudoes.ru
    domain	45loop.crudoes.ru
    domain	46createobject.crudoes.ru
    domain	51journal.crudoes.ru
    domain	51sleep.crudoes.ru
    domain	56chr.crudoes.ru
    domain	56openastextstream.crudoes.ru
    domain	56sleep.crudoes.ru
    domain	57ending.crudoes.ru
    domain	57to.crudoes.ru
    domain	58journal.crudoes.ru
    domain	5xa2bxerikqbklf7k.stradrol.ru
    domain	60asc.crudoes.ru
    domain	62each.crudoes.ru
    domain	63chr.crudoes.ru
    domain	63xor.crudoes.ru
    domain	64ending.crudoes.ru

    copy batch · 95 more in this batch, in the JSON

Further reading 3,071

• attack.mitre.org/groups/G0047
• blog.cloudflare.com/2026-threat-report
• blog.trendmicro.com/trendlabs-security-intelligence/gamared…
• learn.microsoft.com/en-us/microsoft-365/security/intelligen…
• researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-t…
• symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gam…
• unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update…
• bleepingcomputer.com/news/security/ukraine-links-members-of-…
• microsoft.com/security/blog/2022/02/04/actinium-targe…
• secureworks.com/research/threat-profiles/iron-tilden
• welivesecurity.com/2020/06/11/gamaredon-group-grows-its-ga…
• virustotal.com/gui/file/aa07ab7dba1aeb41c57bcdcbca54ce…
• twitter.com/malwrhunterteam/status/1554855093467488…
• virustotal.com/gui/ip-address/167.99.122.30/relations
• virustotal.com/gui/file/4454416fddf42c1a994e306478e1ef…
• twitter.com/spider_girl22/status/1171262839295635457
• virustotal.com/gui/ip-address/45.76.254.179/relations
• twitter.com/s1ckb017/status/1446008070073724932
• virustotal.com/gui/ip-address/193.228.128.225/relations
• virustotal.com/gui/file/5bc819f9a202951e68f31649dbd9bd…
• virustotal.com/gui/file/1c608170bd7f5e270bd3c12d7abdd1…
• virustotal.com/gui/ip-address/92.53.96.150/relations
• virustotal.com/gui/ip-address/194.67.116.14/relations
• virustotal.com/gui/ip-address/159.223.130.64/relations
• virustotal.com/gui/ip-address/85.159.229.85/relations
• virustotal.com/gui/file/fbeff47b70a2423e553a174fb00141…
• virustotal.com/gui/file/56439db8dad8fa4baf6f9ba0f7143c…
• virustotal.com/gui/ip-address/167.88.160.46/relations
• x.com/Maverits/status/1887126198326632850
• virustotal.com/gui/ip-address/207.148.108.45/relations
• twitter.com/Circuitous__/status/1355190838998036486
• virustotal.com/gui/ip-address/89.108.98.240/relations
• x.com/k3yp0d/status/1816234059686895671
• virustotal.com/gui/ip-address/185.143.223.141/relations
• virustotal.com/gui/ip-address/167.88.160.86/relations
• virustotal.com/gui/file/68567fa54ac77bb3cdb617af7e8035…
• twitter.com/malPileDiver/status/1644445710761205762
• virustotal.com/gui/ip-address/45.32.229.226/relations
• virustotal.com/gui/ip-address/91.210.170.72/relations
• virustotal.com/gui/file/9aaa8c778af26767dd8b2f1134a119…

3,031 more, and the report behind every indicator, in G0047.json.