Announcementseverity: High2021-11-04
SBU publicly attributes Gamaredon to FSB Center 18 and names five officers
published by Recorded Future / The Record
Actor
Russian state-sponsored intrusion set publicly attributed by the Security Service of Ukraine (SBU) to FSB officers based in Russian-occupied Crimea. The longest-running publicly-documented intrusion…
Summary
The Security Service of Ukraine (SBU) publicly attributed the Gamaredon / Armageddon intrusion set to Russia's FSB Center for Information Security (Center 18) operating out of occupied Sevastopol, Crimea. The disclosure named five FSB officers — Sklianko, Chernykh, Starchenko, Miroshnychenko, and Sushchenko — and stated the group had conducted more than 5,000 cyberattacks against Ukrainian government and critical infrastructure systems since 2014.
Tags
attributionfsbukrainerussia
Primary source
therecord.mediaOther Gamaredon events
- 2025-04-10Shuckworm targets foreign military mission in Ukraine with updated GammaSteel
- 2023-06-15Symantec details Shuckworm long-running intrusions in Ukrainian military and government
- 2022-09-15Cisco Talos reports Gamaredon info-stealer campaign against Ukrainian government
- 2022-04-20Five Eyes joint advisory AA22-110A names Primitive Bear (Gamaredon) among Russian threats to critical infrastructure
- 2022-02-04Microsoft details ACTINIUM (Gamaredon) operations against Ukrainian organizations