Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Russia’s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine

Summary: Unit 42 mapped three large clusters of Gamaredon (aka Primitive Bear) infrastructure supporting its phishing and malware operations, linking to over 700 malicious domains, 215 IP addresses and more than 100 malware samples. The group, which the Security Service of Ukraine attributed on Nov. 4, 2021 to five Russian FSB officers posted in Crimea, was observed on Jan. 19, 2022 attempting to compromise a Western government entity in Ukraine by uploading a downloader as a resume through a Ukrainian job search platform.

Why it matters: Gamaredon recycles domains across rotating IP infrastructure - roughly two new IP addresses a day, 131 of 136 recent ones hosted in Russia - so blocking yesterday's indicators does not close the door on a group that has targeted Ukrainian government bodies since 2013.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related