TIARAS - GCMAN

Threat Actor Profile

High APT

Description

GCMAN is a threat group that focuses on targeting banks for the purpose of transferring money to e-currency services. (Citation: Securelist GCMAN)

Confidence Score

90%

Known Aliases

GCMAN

First Seen

Unknown

Last Updated

Unknown

Active Status

Active

Created

April 29, 2026

MITRE ATT&CK Techniques (2)

T1021.004 - SSH

Lateral Movement

T1021.005 - VNC

Lateral Movement

Indicators of Compromise

Loading IOCs…

IOC KQL for Sentinel

STIX Data

{'aliases': ['GCMAN'],
 'created': '2017-05-31T21:32:05.611Z',
 'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'description': '[GCMAN](https://attack.mitre.org/groups/G0036) is a threat '
                'group that focuses on targeting banks for the purpose of '
                'transferring money to e-currency services. (Citation: '
                'Securelist GCMAN)',
 'external_references': [{'external_id': 'G0036',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/groups/G0036'},
                         {'description': '(Citation: Securelist GCMAN)',
                          'source_name': 'GCMAN'},
                         {'description': "Kaspersky Lab's Global Research & "
                                         'Analysis Team. (2016, February 8). '
                                         'APT-style bank robberies increase '
                                         'with Metel, GCMAN and Carbanak 2.0 '
                                         'attacks. Retrieved April 20, 2016.',
                          'source_name': 'Securelist GCMAN',
                          'url': 'https://securelist.com/apt-style-bank-robberies-increase-with-metel-gcman-and-carbanak-2-0-attacks/73638/'}],
 'id': 'intrusion-set--0ea72cd5-ca30-46ba-bc04-378f701c658f',
 'modified': '2025-04-25T14:49:37.572Z',
 'name': 'GCMAN',
 'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
 'spec_version': '2.1',
 'type': 'intrusion-set',
 'x_mitre_attack_spec_version': '3.2.0',
 'x_mitre_deprecated': False,
 'x_mitre_domains': ['enterprise-attack'],
 'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'x_mitre_version': '1.1'}