Gallmaker

APT Group Information theft and espionage ETDA ✓

Also Known As

No alias recorded

Target Countries

No target country recorded

Sectors Targeted

Embassies Defense Government

Details

Origin null

Last Updated 01 Jun 2022

MITRE ATT&CK 15

T1027 T1059 T1059.001 T1059.003 T1071.001 T1082 T1204 T1204.002 T1559 T1559.002 T1560 T1560.001 T1566 T1566.001 T1574

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 2 entries

Gallmaker Symantec

G0084 MITRE

Observed Target Countries 1

Based on ETDA data — countries highlighted in red

Eastern Europe and Middle East

Description

(Symantec) Symantec researchers have uncovered a previously unknown attack group that is targeting government and military targets, including several overseas embassies of an Eastern European country, and military and defense targets in the Middle East. This group eschews custom malware and uses living off the land (LotL) tactics and publicly available hack tools to carry out activities that bear all the hallmarks of a cyber espionage campaign. The group, which we have given the name Gallmaker, has been operating since at least December 2017, with its most recent activity observed in June 2018.

Tools Used 1

Living off the Land

Reports & References 1

https://www.symantec.com/blogs/threat-intelligence/gallmaker-attack-group

ETDA Profile

Gallmaker

Origin

[Unknown]

First Seen 2017

Motivation

Information theft and espionage

MITRE ATT&CK Groups

https://attack.mitre.org/groups/G0084/

View on ETDA APT Groups ↗