# Passive DNS Pivoting Uncovers 122 New ACTINIUM (Gamaredon) Infrastructure Domains

> Independent researchers used Validin passive-DNS pivoting on the 124 domains Microsoft (MSTIC) attributed to ACTINIUM/Gamaredon in its February 2022 report to identify 122 additional .ru domains sharing the pivot IP 139.180.174[.]234, a coordinated July 27, 2022 registration/resolution cluster, and algorithmically-generated subdomain wordlist patterns consistent with confirmed ACTINIUM infrastructure.

- **Published:** 2026-07-18T00:00:00Z
- **Last reviewed:** 2026-07-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1484
- **ID:** TL-2026-1484
- **Severity:** MEDIUM
- **Category:** THREAT_ACTOR
- **Status:** ACTIVE
- **Actor:** Gamaredon Group (Russia)
- **Detections:** 9 · **IOCs:** 39 (full data via the Threadlinqs MCP server — Purple tier)

## Description

ACTINIUM (aka Gamaredon Group, Primitive Bear, IRON TILDEN, Armageddon, Shuckworm, DEV-0157, Aqua Blizzard, NastyShrew; MITRE ATT&CK G0047) is a Russia-nexus cyber-espionage actor active since at least 2013 and publicly attributed by the Ukrainian government in November 2021 to the Russian Federal Security Service (FSB) Center 18, operating out of Crimea/Sevastopol. The group has maintained a near-decade-long campaign against Ukrainian government, military, judiciary, law enforcement, and non-profit organizations, prioritizing intelligence collection and exfiltration over destructive impact, while periodically supporting disk-wipe/defacement capability alongside its core espionage tradecraft.

On February 4, 2022, Microsoft's MSTIC published a detailed report on ACTINIUM (then tracked as DEV-0157) documenting spear-phishing-driven intrusions using malicious macro documents with remote template injection, and enumerated a set of infrastructure indicators including domains, IPs, and file hashes for the group's malware families (Pteranodon/Pterodo, PowerPunch, QuietSieve, ObfuBerry, ObfuMerry, DilongTrash, DinoTrain, DesertDown). Independent tri-vendor tracking (Microsoft, Palo Alto Networks, Symantec) around the same period produced a combined pool of 151 unique domains attributed to the group.

On March 30, 2024, Embee Research published a passive-DNS pivoting analysis (using the Validin platform and CyberChef for indicator extraction) that bulk-resolved the 124 Microsoft-reported domains, yielding roughly 20,402 raw DNS indicators. Frequency analysis of the resulting IP set identified 139.180.174[.]234 as the single most reused hosting IP, appearing across 49 of the 124 original domains, with a pronounced resolution spike around July 27, 2022 indicating a coordinated infrastructure deployment/rotation event. Pivoting on that IP and the July 27, 2022 temporal cluster, then filtering to the .ru TLD and extracting primary (registrable) domains from the associated subdomain sets, the researchers derived a set-difference of 122 additional .ru domains not present in Microsoft's original disclosure but sharing the same hosting IP, registration-date clustering, and randomized-wordlist subdomain generation convention (each parent domain hosts numerous algorithmically-named subdomains drawn from an English wordlist) that Microsoft and ESET have separately documented as an ACTINIUM/Gamaredon operational signature. The researchers explicitly caveat that the pivot examined only a single IP address and that some results may be false positives, meaning further undiscovered infrastructure likely exists via other IP or ASN pivots.

This expansion is consistent with ACTINIUM's documented high-tempo infrastructure churn: Microsoft's original report and follow-on vendor tracking (e.g., CIRCLEID's April 2022 infrastructure analysis) describe the group registering 25+ new domains and 80+ unique IPs monthly, favoring ASN 197695 (REG.RU) and the REG.RU registrar, with DNS records changing roughly daily — a pattern that renders point-in-time domain lists rapidly stale and motivates continuous passive-DNS-based hunting of the type performed in this research. Subsequent ESET reporting on Gamaredon's 2024-2025 activity confirms the group's continued evolution, including hiding C2 infrastructure behind Cloudflare tunnels/workers, abusing third-party services (Telegram, Telegraph, Dropbox, Mastodon, DEV Community) as dead-drop resolvers, and upgrading file-stealer tooling (PteroPSDoor, PteroVDoor) to exfiltrate to S3-compatible object storage (Wasabi, Tebi, Intercolo) — underscoring that the domain set documented here represents one historical snapshot (July 2022 cluster) within a long-running, still-active infrastructure lifecycle rather than the totality of current ACTINIUM/Gamaredon assets.

No CVE or software exploitation is involved in this activity; ACTINIUM's initial access relies on spear-phishing with malicious macro/template-injection documents rather than vulnerability exploitation. This record documents an infrastructure-hunting/OSINT finding that materially expands blocklist and detection coverage for a nation-state espionage actor's historical (2022) domain footprint.

## MITRE ATT&CK

- T1583.001 Domains
- T1583.003 Virtual Private Server
- T1587.003 Digital Certificates
- T1588.002 Tool
- T1608.001 Upload Malware
- T1566.001 Spearphishing Attachment
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.005 Visual Basic
- T1106 Native API
- T1053.005 Scheduled Task
- T1218.005 Mshta
- T1218.011 Rundll32
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1047 Windows Management Instrumentation
- T1547.001 Registry Run Keys / Startup Folder
- T1137 Office Application Startup
- T1091 Replication Through Removable Media
- T1548.002 Bypass User Account Control
- T1140 Deobfuscate/Decode Files or Information
- T1685 Disable or Modify Tools
- T1480 Execution Guardrails
- T1564.003 Hidden Window
- T1070.004 File Deletion
- T1027 Obfuscated Files or Information
- T1027.004 Compile After Delivery
- T1027.010 Command Obfuscation
- T1027.012 LNK Icon Smuggling
- T1027.015 Compression
- T1027.016 Junk Code Insertion
- T1112 Modify Registry
- T1036.005 Match Legitimate Resource Name or Location
- T1497.001 System Checks
- T1010 Application Window Discovery
- T1083 File and Directory Discovery
- T1135 Network Share Discovery
- T1120 Peripheral Device Discovery
- T1018 Remote System Discovery
- T1057 Process Discovery

## Sources

- [Uncovering APT Infrastructure with Passive DNS Pivoting](https://www.embeeresearch.io/uncovering-apt-infrastructure-with-passive-dns-pivoting/)
- [ACTINIUM targets Ukrainian organizations](https://www.microsoft.com/en-us/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/)
- [Microsoft Uncovers New Details of Russian Hacking Campaign Targeting Ukraine](https://thehackernews.com/2022/02/microsoft-uncovers-new-details-of.html)
- [A Look at Actinium/Gamaredon's Infrastructure: More Artifacts Revealed](https://circleid.com/posts/20220411-a-look-at-actinium-gamaredons-infrastructure-more-artifacts-revealed)
- [Cyber threat activity in Ukraine: analysis and resources](https://www.microsoft.com/en-us/msrc/blog/2022/02/analysis-resources-cyber-threat-activity-ukraine)
- [Gamaredon Group, G0047 - MITRE ATT&CK](https://attack.mitre.org/groups/G0047/)
- [Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset](https://www.welivesecurity.com/en/eset-research/gamaredon-2024-cranking-out-spearphishing-campaigns-ukraine-evolved-toolset/)
- [Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances](https://www.welivesecurity.com/en/eset-research/gamaredon-2025-leveraging-tunnels-workers-dead-drops-new-alliances/)
- [Microsoft discloses new details on Russian hacker group Gamaredon](https://venturebeat.com/2022/02/04/microsoft-discloses-new-details-on-russian-hacker-group-gamaredon/)
- [ACTINIUM threat actors target organizations in Ukraine](https://securezoo.com/2022/02/actinium-threat-actors-target-organizations-in-ukraine/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1484