What other aliases and vendor names is Gamaredon known by?

Gamaredon is tracked across the cybersecurity industry by multiple aliases, including: ACTINIUM, Primitive Bear, Armageddon, Shuckworm.

What are the primary motivations and sponsors of Gamaredon?

Gamaredon operates from Russia with primary motivation categorized as Espionage, Sabotage (Ukraine-focused), sponsored or affiliated with FSB (Federal Security Service).

What vulnerabilities and CVEs does Gamaredon actively exploit?

Gamaredon has been observed weaponizing vulnerabilities including CVE-2017-0199, CVE-2017-11882.

Gamaredon

▲ High Threat Russia

Primary Aliases: Primitive Bear ACTINIUM Armageddon Shuckworm

Sponsor / State Affiliation FSB (Federal Security Service)

Primary Motivation Espionage, Sabotage (Ukraine-focused)

Active Timeline 2013 – Present

Confidence Rating 70% (Grounded)

Most active APT targeting Ukraine, over 5000 phishing attacks against Ukrainian entities

⚔️ Weaponized CVE Matrix (2)

CVE-2017-0199

Weaponized Vulnerability

CVSS 8.5 KEV EPSS 85.0%

CVE-2017-11882

Weaponized Vulnerability

CVSS 8.5 KEV EPSS 85.0%

🎯 Target Sectors & Focus

Ukraine government Military NGOs Law enforcement

🛡️ MITRE ATT&CK® Attack Lifecycle (5 TTPs)

📥 Download Navigator JSON

Initial Access 1

T1566 Spear-phishing

↗

Credential Access & Discovery 1

T1003 Credential harvesting

↗

Command & Control 1

T1071 Pterodo backdoor

↗

Operational Techniques 2

T1000 USB worms

↗

T1000 High-volume low-sophistication attacks

↗

📰 Verified Campaigns & Intelligence Archive

🔔 Subscribe to Alerts

[DEEP DIVE] Russian State-Sponsored Deployment of StockStay and SharkLoader

Attacks and Vulnerabilities 2026-07-03

Copied to clipboard

LINK COPIED TO CLIPBOARD

Gamaredon

⚔️ Weaponized CVE Matrix (2)

🎯 Target Sectors & Focus

🛡️ MITRE ATT&CK® Attack Lifecycle (5 TTPs)

📰 Verified Campaigns & Intelligence Archive

SHARE INTELLIGENCE WIRE