OldGremlin is a financially motivated cybercrime group, first documented in March 2020, that conducts highly targeted ransomware campaigns primarily against organizations within Russia. The group is distinguished by its unique operational focus on Russian entities, a rarity among ransomware groups, which typically avoid targeting organizations in post-Soviet countries. OldGremlin consistently employs custom-developed malware and sophisticated social engineering tactics, including well-researched phishing emails that exploit current events to gain initial access. The group maintains an average dwell time of 49 days within victim networks before deploying ransomware, allowing for extensive reconnaissance and backup deletion. Unlike many other ransomware operators, OldGremlin does not typically engage in double extortion, focusing instead on significant ransom demands proportionate to the victim's size and revenue. The group is also known by the alias TinyScouts.

Aliases del actor

oldgremlintinyfluff