Gamaredon Group
No sourced public emblem in this profile.
reference profile · reported nexus: RU (not nationality)
Unit 42 threat researchers have recently observed a threat group distributing new, custom developed malware. We have labelled this threat group the Gamaredon Group and our research shows that the Gamaredon Group has been active since at least 2013. In the past, the Gamaredon Group has relied heavily on off-the-shelf tools. Our new research shows the Gamaredon Group have made a shift to custom-developed malware. We believe this shift indicates the Gamaredon Group have improved their technical capabilities.
Source-reported aliases: ACTINIUM, DEV-0157, Blue Otso, BlueAlpha, G0047, IRON TILDEN, PRIMITIVE BEAR, Shuckworm, Trident Ursa, UAC-0010, Winterflounder, Aqua Blizzard, Actinium. Associations do not prove equivalence.
Target geography
Catalog-listed countries (associations, not attack counts): 
Ukraine · 
Germany
No bound claim-post feed for this label.
Historical casebook
No dated record curated yet; absence does not establish inactivity.
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
No assigned review window.
References
https://www.lookingglasscyber.com/wp-content/uploads/2015/08/Operation_Armageddon_Final.pdf
https://unit42.paloaltonetworks.com/unit-42-title-gamaredon-group-toolset-evolution
https://attack.mitre.org/groups/G0047
https://github.com/StrangerealIntel/CyberThreatIntel/tree/master/Russia/APT/Gamaredon
https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf
https://www.welivesecurity.com/2020/06/18/digging-up-invisimole-hidden-arsenal
https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations
https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game
https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021
https://go.recordedfuture.com/hubfs/reports/cta-2019-1212.pdf
https://unit42.paloaltonetworks.com/atoms/tridentursa
https://cert.gov.ua/article/1229152
https://cert.gov.ua/article/971405
https://cert.gov.ua/article/40240
https://cert.gov.ua/article/39386