Gamaredon, also known as Primitive Bear, UNC530, ACTINIUM, or Aqua Blizzard (by Microsoft) is a Russian advanced persistent threat that has been active since at least 2013.
Cyber espionage appears to be the main goal of the group,; unlike most APTs, Gamaredon broadly targets all users all over the globe (in addition to also focusing on certain victims, especially Ukrainian organizations) and appears to provide services for other APTs. For example, the InvisiMole threat group has attacked select systems that Gamaredon had earlier compromised and fingerprinted.
The group frequently uses spear phishing techniques with malicious code attachments that download remote templates containing malware.
Malware used by the group includes Pterodo, PowerPunch, ObfuMerry, ObfuBerry, DilongTrash, DinoTrain, and DesertDown.
In November 2021 the Ukrainian Security Service linked the group, which it tracks as Armageddon, to the Crimean branch of Russia's Federal Security Service (FSB). It said the group operated from Sevastopol and acted on orders from the FSB's Center for Information Security in Moscow. According to the agency, the group had carried out over 5,000 cyberattacks on more than 1,500 Ukrainian government systems since June 2013.
On 19 January 2022, they attempted to compromise a Western government entity in Ukraine.
In October 2024 two hackers linked to the group were sentenced in absentia in Ukraine to 15 years in prison. Both were affiliated with the Russian Federal Security Service (FSB). They had been found guilty of treason and unauthorized access to computers.