ANDROMEDA

Description

ANDROMEDA (a.k.a. Gamarue) is a modular botnet that first appeared around 2011 and grew into one of the most widely distributed malware families of its era. It spreads through spam emails, exploit kits, and infected removable drives, and it acts as a downloader that pulls additional malware families onto infected systems. An international takedown in late 2017 disrupted much of its infrastructure, but code from the family continues to surface in new campaigns.

Stats

First seen

March 2022

Last seen

October 2026

MITRE ATT&CK techniques

7 techniques across 4 tactics.

Associated campaigns

• C0026C0026

Alert name variants

Related IPS Signatures

Related families

References

• malpedia.caad.fkie.fraunhofer.de →
• attack.mitre.org →