Cataloged
IdentityTracking identifier: G0047
Reviewed identity mapping approved on this date.
Gamaredon Group
Also known as IRON TILDEN, Primitive Bear, ACTINIUM, Armageddon, Shuckworm, DEV-0157, Aqua Blizzard, NastyShrew
Tracked as
G0047
Gamaredon Group is a suspected Russian cyber espionage group that has targeted military, law enforcement, judiciary, non-profit, and non-governmental organizations in Ukraine since at least 2013. The name Gamaredon Group derives from a misspelling of the word "Armageddon," found in early campaigns. In November 2021, the Ukrainian government publicly attributed Gamaredon Group to Russia’s Federal Security Service (FSB) Center 18, an assessment later supported by multiple independent cybersecurity researchers.
Activity timeline
A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.
Cataloged
IdentityAlias: IRON TILDEN
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: Primitive Bear
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: ACTINIUM
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: Armageddon
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: Shuckworm
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: DEV-0157
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: Aqua Blizzard
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: NastyShrew
Reviewed identity mapping approved on this date.
Identity and attribution
Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.
Name map
Gamaredon GroupCanonical Name
ACTINIUMAlias
Aqua BlizzardAlias
ArmageddonAlias
DEV-0157Alias
IRON TILDENAlias
NastyShrewAlias
Primitive BearAlias
ShuckwormAlias
G0047Tracking Id
Loading CVEs, techniques, indicators, malware, victims, and activity...