Malicious Activity Aligning with Gamaredon TTPs Targets Ukraine

The Anomali Threat Research (ATR) team has identified malicious activity that we believe is being conducted by the Russia-sponsored Advanced Persistent Threat (APT) group Gamaredon (Primitive Bear).

Anomali Threat Research

Published on

December 5, 2019

Table of Contents

Overview

The Anomali Threat Research (ATR) team has identified malicious activity that we believe is being conducted by the Russia-sponsored Advanced Persistent Threat (APT) group Gamaredon (Primitive Bear). Some of the documents have been discussed by other researchers.[1] This Gamaredon campaign appears to have begun in mid-October 2019 and is ongoing as of November 25, 2019. Based on lure documents observed by ATR, we believe that at least the following Ukrainian entities and individuals may be targeted:

Diplomats
Government officials and employees
Journalists
Law enforcement
Military officials and personnel
Non-Governmental Organization (NGO)
The Ministry of Foreign Affairs of Ukraine

ATR analysts have found Tactics, Techniques, and Procedures (TTPs) that align with known Gamaredon tactics, in addition to a new template-injection technique that has not previously been observed to be utilized by the group.

The object of this report is to highlight a new Gamaredon TTP and share IOCs to the security community for awareness and further analysis. Several lure documents will also be examined, as well as a technical analysis section that showcases the functionalities of the template injection.

Get the full report on Gamaredon (Primitive Bear) and read through our key findings here.

Endnotes

[1] Evgeny Ananin and Artern Semenchenko “The Gamaredon Group: A TTP Profile Analysis,” Fortinet Blog, accessed November 25, 2019, published August 21 2019, https://www.fortinet.com/blog/threat-research/gamaredon-group-ttp-profile-analysis.html; ZLAB-YOROI, “The Russian Shadow in Eastern Europe: Ukrainian MOD Campaign,” YOROI Blog, accessed November 25, 2019, published April, 24, 2019 https://blog.yoroi.company/research/the-russian-shadow-in-eastern-europe-ukrainian-mod-campaign/; ZLAB-YOROI, “The Russian Shadow in Eastern Europe: A Month Later,” YORIO Blog, accessed November 25, 2019, published June 4, 2019, https://blog.yoroi.company/research/the-russian-shadow-in-eastern-europe-a-month-later/.

FEATURED RESOURCES

January 29, 2026

Threat Intelligence Platform

Cyber Threat Intelligence

The Threat Intelligence Market Is Changing: Five Shifts Redefining How Intelligence Creates Value

January 27, 2026

Anomali Cyber Watch

Anomali Cyber Watch: Evelyn Stealer Abuses, PDFSider Malware, Open-Source Tools Deploy RAT and more

Evelyn Stealer Abuses Developer Tooling to Harvest Credentials. Stealthy Backdoor Abuse: PDFSider Malware Evades Detection and Enables Persistent Access. Social Media Phishing Campaign Leverages Open-Source Tools to Deploy RAT. And More..

January 20, 2026

Anomali Cyber Watch

Anomali Cyber Watch: Remcos RAT, BitB phishing, Linux Malware Framework, Supply Chain Intrusion and more

New Malware Campaign Delivers Remcos RAT Through Text-Only Staging and Living-Off-the-Land Execution. Browser-in-the-Browser Phishing Evolves into a High-Fidelity Credential Trap. Cloud-Aware Linux Malware Framework Poised for Future Threats. And More..

Explore All