OldGremlin
OldGremlin is a Russia-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets 6 sectors, including Manufacturing and Finance, in Russia. It uses 18 MITRE ATT&CK techniques.
- Origin
- Russia
- Techniques
- 18
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2020
- Record updated
Who They Target.
About OldGremlin.
OldGremlin is one of the less well-known but more dangerous Russian-speaking criminal organizations to emerge in the last few years. The criminal organization's activity has been tracked back to at least 2020, and it has achieved a high level of operational discipline as well as a reputation in some quarters for the extended dwell time of their malware on compromised computer networks and systems and a "strategic approach" to infiltrating corporate environments. OldGremlin's attack methodology differs from most other ransomware groups in that it is a low-volume, very high-impact group that typically take months to execute their operational plans. The way that OldGremlin combines traditional advanced persistent threat (APT) tactics (reconnaissance stage, credential collection, lateral movement) with a very refined method of extorting ransom payments as a result of their infiltration and unauthorized access to corporate networks gives them an opportunity to be a hybrid organization, straddling the line between large-scale cybercriminal operations and APTs (Advanced Persistent Threat).
Last updated Sep 30, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.