Description
[Gallmaker](https://attack.mitre.org/groups/G0084) is a cyberespionage group that has targeted victims in the Middle East and has been active since at least December 2017. The group has mainly targeted victims in the defense, military, and government sectors.(Citation: Symantec Gallmaker Oct 2018)
Techniques Used (TTPs)
- T1204.002 — Malicious File (execution)
- T1027 — Obfuscated Files or Information (defense-evasion)
- T1560.001 — Archive via Utility (collection)
- T1559.002 — Dynamic Data Exchange (execution)
- T1059.001 — PowerShell (execution)
- T1566.001 — Spearphishing Attachment (initial-access)
Total TTPs: 6