H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Group

Gallmaker

[Gallmaker](https://attack.mitre.org/groups/G0084) is a cyberespionage group that has targeted victims in the Middle East and has been active since at least December 2017. The group has mainly targeted victims in the defense, military, and government sectors.(Citation: Symantec Gallmaker Oct 2018)

Group
TypeGroup
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Gallmaker](https://attack.mitre.org/groups/G0084) is a cyberespionage group that has targeted victims in the Middle East and has been active since at least December 2017. The group has mainly targeted victims in the defense, military, and government sectors.(Citation: Symantec Gallmaker Oct 2018)

6 recorded

Relationships

uses
to Archive via Utility
Technique
uses
to Dynamic Data Exchange
Technique
uses
to Malicious File
Technique
uses
to Obfuscated Files or Information
Technique
uses
to PowerShell
Technique
uses
to Spearphishing Attachment
Technique
3 external

References

mitre-attack
G0084
open
Gallmaker
—
Symantec Gallmaker Oct 2018
https://www.symantec.com/blogs/threat-intelligence/gallmaker-attack-group
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance