Microsoft said today that a Russian hacking group known as Gamaredon has been behind a streak of spear-phishing emails targeting Ukrainian entities and organizations related to Ukrainian affairs since October 2021.
Linked by Ukraine’s security (SSU) and secret (SBU) services to Russia’s Federal Security Service (FSB), the country’s domestic intelligence service, this hacking group is also tracked as Armageddon, Primitive Bear, and ACTINIUM.
Gamaredon has been active for at least a decade and has been behind thousands of attacks on Ukrainian orgs since 2013.
Security and threat researchers with the Microsoft Threat Intelligence Center (MSTIC) and the Microsoft Digital Security Unit (DSU) said today that Gamaredon’s cyber-espionage campaign is being coordinated out of Crimea, confirming SSU’s assessment that the Gamaredon hackers are officers of the Crimean FSB who sided with Russia during the 2014 occupation.
MSTIC has observed ACTINIUM targeting organizations in Ukraine spanning government, military, non-government organizations (NGO), judiciary, law enforcement, and non-profit, with the primary intent of exfiltrating sensitive information, maintaining access, and using acquired access to move laterally into related organizations, Microsoft added.