{
  "id": "gallmaker",
  "name": "Gallmaker",
  "aliases": [],
  "domain": "cyber",
  "country": "UNK",
  "category": "Unattributed cyber threat group",
  "status": "tracked",
  "fielded": null,
  "operators": [],
  "summary": "Gallmaker is a cyberespionage group that has targeted victims in the Middle East and has been active since at least December 2017. The group has mainly targeted victims in the defense, military, and government sectors.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Not attributed by ATT&CK",
      "src": [
        "mitre-g0084"
      ],
      "conf": "low"
    },
    {
      "k": "active_since",
      "v": 2017,
      "src": [
        "mitre-g0084"
      ],
      "conf": "medium",
      "note": "At least 2017"
    },
    {
      "k": "attack_id",
      "v": "G0084",
      "src": [
        "mitre-g0084"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "Gallmaker is a cyberespionage group that has targeted victims in the Middle East and has been active since at least December 2017.",
      "src": [
        "mitre-g0084"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 6,
      "src": [
        "mitre-g0084"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "Gallmaker is a cyberespionage group that has targeted victims in the Middle East and has been active since at least December 2017. The group has mainly targeted victims in the defense, military, and government sectors. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G0084)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/gallmaker.html",
  "sources": {
    "mitre-g0084": {
      "title": "Gallmaker, Group G0084",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G0084/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}