Gamaredon
aka Aqua Blizzard, Primitive Bear, Shuckworm, Armageddon, ACTINIUM, IRON TILDEN
A Russian group that relentlessly targets Ukraine's government, military and police at high volume. Ukraine says it is an FSB Center 18 unit, and in 2025 it very likely handed access to Turla.
- Alert level
- 1/ 5
- Reports & advisories (90 days)
- 0
- Known exploited CVEs
- 0
- Personal data leaked (disclosed)
- None confirmed
Attribution
- Notes Ukraine's government attributed it to FSB Center 18 — MITRE ATT&CK
- Assessed as FSB-linked and very likely giving Turla access to victims — ESET
How they attack
Entry
Waves of targeted phishing
Like mailing addressed letters with hidden traps over and over until someone opens one.
Entry
Spreading via USB drives
Like sticking a trap on a shared folder that spreads to every desk it is passed to.
Inside
Hiding relays on free public services
Like posting instructions on a busy station notice board so nobody can tell who put them there.
Goal
Handing access to a partner group
Like handing only the keys to the most valuable houses over to a more skilled partner.
Sources
Attributions are quoted as assessed by governments and security vendors. VulnPulse does not make attributions itself.
Leak counts only add up figures disclosed by the affected companies or authorities, never the attackers' own claims. We do not list victim names or link to leak sites.
The alert level is calculated automatically from reports and advisories in the last 90 days, known exploited vulnerabilities, and whether the group has targeted Japan.
Updated 2026-10-23 · daily