Gamaredon
Gamaredon, also known as Primitive Bear, UNC530, ACTINIUM, or Aqua Blizzard is a Russian advanced persistent threat that has been active since at least 2013.
Motivation
Cyber espionage appears to be the main goal of the group,; unlike most APTs, Gamaredon broadly targets all users all over the globe and appears to provide services for other APTs. For example, the InvisiMole threat group has attacked select systems that Gamaredon had earlier compromised and fingerprinted.Tactics
The group frequently uses spear phishing techniques with malicious code attachments that download remote templates containing malware.Malware used by the group includes Pterodo, PowerPunch, ObfuMerry, ObfuBerry, DilongTrash, DinoTrain, and DesertDown.