Trident Ursa

Trident Ursa, also known as Gamaredon, Shuckworm, Actinium, Armageddon, Primitive Bear, and UAC-0010, is a threat actor attributed to Russia's Federal Security Service by the Security Service of Ukraine. This group has been active since 2014, primarily focusing on Ukrainian entities such as government employees, journalists, and military personnel. Trident Ursa employs various techniques to limit URL access and uses phishing emails as part of their tactics. The group was observed using a multistage backdoor named Pteranodon/Pterodo, which can execute payloads received from the command and control center (C&C). The group's operations have shown no signs of slowing down since its inception, consistently targeting security services, military, and government organizations in Ukraine. The latest phishing documents used by Trident Ursa have low detection rates in VirusTotal, likely due to their simplicity. The initial VBScript responsible for enabling persistent access to systems does so by creating a Windows scheduled task and a registry key, both common techniques used by Trident Ursa. Despite their success, Trident Ursa does not employ overly sophisticated or complex techniques in its operations, demonstrating agility and adaptability instead. Their continued operation highlights the need for robust cybersecurity measures, with prevention being the best defense against such advanced persistent threats (APTs). Therefore, maintaining a security posture that favors prevention is crucial to mitigate the risks posed by groups like Trident Ursa.