Advisoryseverity: High2022-04-20
Five Eyes joint advisory AA22-110A names Primitive Bear (Gamaredon) among Russian threats to critical infrastructure
published by CISA
Actor
Russian state-sponsored intrusion set publicly attributed by the Security Service of Ukraine (SBU) to FSB officers based in Russian-occupied Crimea. The longest-running publicly-documented intrusion…
Summary
CISA, FBI, NSA and partner agencies from Australia, Canada, New Zealand and the United Kingdom issued joint advisory AA22-110A on Russian state-sponsored and criminal cyber threats to critical infrastructure. The advisory cited Primitive Bear (Gamaredon) as a long-running FSB-attributed actor targeting Ukrainian government, military and law enforcement entities since at least 2013, reaffirming Ukraine's November 2021 attribution to FSB Center 18.
Tags
joint-advisoryfive-eyescritical-infrastructure
Primary source
cisa.govOther Gamaredon events
- 2025-04-10Shuckworm targets foreign military mission in Ukraine with updated GammaSteel
- 2023-06-15Symantec details Shuckworm long-running intrusions in Ukrainian military and government
- 2022-09-15Cisco Talos reports Gamaredon info-stealer campaign against Ukrainian government
- 2022-02-04Microsoft details ACTINIUM (Gamaredon) operations against Ukrainian organizations
- 2021-11-04SBU publicly attributes Gamaredon to FSB Center 18 and names five officers