Loading malware…
QuietSieve is a Windows information-stealing malware family associated with the Russian state-linked Gamaredon threat cluster, also tracked as ACTINIUM, Armageddon, Shuckworm, Primitive Bear, Trident Ursa, DEV-0586, and UAC-0010. It has been used in cyber-espionage operations primarily targeting Ukrainian organizations, including government and military entities. Microsoft classified QuietSieve as a distinct stealer family within Gamaredon’s broader malware ecosystem.
QuietSieve is designed for collection from compromised hosts. Reported capabilities include searching local-accessible removable media and networked drives for files matching targeted extensions, collecting files from the victim system, and taking periodic screenshots for later theft. It has also been observed executing payloads in a hidden window, indicating an effort to reduce user visibility and support defense evasion during follow-on activity. In addition, it performs basic connectivity checks consistent with validating outbound communications before or during command-and-control activity.
Operationally, QuietSieve fits Gamaredon’s long-running espionage tradecraft focused on rapid deployment, modular tooling, and theft of documents from Windows environments. Its emphasis on harvesting files from removable and networked storage aligns with collection against distributed user data and shared organizational resources. The malware’s observed behavior supports its role as a targeted espionage stealer rather than a disruptive or destructive payload.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
ACTINIUM targets Ukrainian organizations Pteranodon QuietSieve ... DilongTrash DinoTrain Pteranodon QuietSieve
10 distinct techniques documented for this family, organized by ATT&CK tactic.
Agent Tesla has used ProcessWindowStyle.Hidden to hide windows. APT-C-36 has set the ShowWindow property of the Win32_ProcessStartup object to zero to hide PowerShell execution. APT19 used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.
Multiple actors and malware check for internet/network connectivity using ping, tracert, HTTP GET requests, or contacting well-known domains (e.g., google[.]com, bing[.]com, 8.8.8.8) prior to tool transfer or C2 establishment.
The content repeatedly describes malware and threat actors listing files and directories, enumerating drives, searching for files by extension/name/path, retrieving file metadata, and browsing file systems (for example: "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection" and "cmd can be used to find files and directories with native functionality such as dir commands").
ADVSTORESHELL can list connected devices. APT28 uses a module to receive a notification every time a USB mass storage device is inserted into a victim. APT37 has a Bluetooth device harvester, which uses Windows Bluetooth APIs to find information on connected Bluetooth devices.
The content repeatedly describes threat actors and malware collecting, stealing, identifying, copying, or staging files, documents, credentials, logs, databases, and other information from compromised hosts or local systems.
"Agent Tesla can capture screenshots of the victim’s desktop"; "AppleSeed can take screenshots on a compromised host"; "APT28 has used tools to take screenshots from victims"; "Cobalt Strike's Beacon payload is capable of capturing screenshots"; "PowerSploit's Get-TimedScreenshot Exfiltration module can take screenshots at regular intervals"; "Hydraq includes a component based on the code of VNC that can stream a live feed of the desktop"
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Stealer family name used by MSTIC for a Gamaredon exfiltration component; the report aligns it under the GammaSteel taxonomy.
A named malware/tool in Microsoft’s ACTINIUM/Gamaredon reporting, used in targeting Ukrainian organizations.
Malware that executes payloads in hidden windows for stealth.
Collection-focused malware that identifies and searches networked drives for specific file extensions.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.