NEW: Group Profiler — instant APT intel lookup. Try it →

GCMAN

G0036 MITRE ATT&CK →

Overview

GCMAN is a threat group that focuses on targeting banks for the purpose of transferring money to e-currency services.

Naming & attribution

GCMAN is tracked under 1 names across the industry. It uses 2 documented ATT&CK techniques — more than 5% of the 174 groups tracked here.

Who calls this group what — MITRE lists each alias with the report that used it, but not which vendor coined it.
Name	First reported by
GCMAN	Kaspersky Lab's Global Research & Analysis Team

Targets

Finance

TTPs — 2 techniques across 1 tactics

Lateral Movement

T1021.004 SSH
T1021.005 VNC

Reporting (1)

APT-style bank robberies increase with Metel, GCMAN and Carbanak 2.0 attacks — Kaspersky Lab's Global Research & Analysis Team