group

GCMAN G0036

Created: 31 May 2017
Last modified: 31 July 2026
Alias: GCMAN

GCMAN is a threat group that focuses on targeting banks for the purpose of transferring money to e-currency services. [1]

TechniquesBottom 8%

TacticBottom 6%

Tools & malwareNone recorded

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

GCMAN MITRE reference G0036

SSH T1021.004 ↗

GCMAN uses Putty for lateral movement.2

Lateral Movement15 detection rules

VNC T1021.005 ↗

GCMAN uses VNC for lateral movement.3

Lateral Movement1 detection rules

Standing G0036

Reach is how much of ATT&CK this group touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 176 ATT&CK groups only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques2Bottom 8%

8th percentile · 92% of 176 ATT&CK groups have more Enterprise techniques.

Tactic1Bottom 6%

6th percentile · 94% of 176 ATT&CK groups have more tactics spanned.

Tools & malware0Bottom 9%

9th percentile · 91% of 176 ATT&CK groups have more tools and malware.

Campaigns089% tie · 4 values

89% of the population shares a single value across only 4 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique8medBottom 18%

18th percentile · 82% of 176 ATT&CK groups have more detection rules per technique.

Tests / technique1.5med

GCMAN detections G0036

16 distinct rules cover the 2 techniques recorded for this group. 10 Splunk · 6 Sigma.

2 covered by at least one rule16 distinct rules in total

Showing 1-16 of 16 rules

Drag headers to reorder | Drag edges to resize

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects Bitbucket global SSH access configuration changes.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Defense Impairment Disable or Modify Tools Lateral Movement Remote Services SSH	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	16ab6143-510a-44e2-a615-bdb80b8317fc
	Detects SSH user login access failures. (...)	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Credential Access Brute Force Lateral Movement Remote Services SSH	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	d3f90469-fb05-42ce-b67d-0fded91bbef3
Splunk	This analytic detects bursts of ping, SSH, and Telnet commands issued from Cisco IOS or NX-OS devices. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Discovery Network Service Discovery Lateral Movement Remote Services SSH Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	efb20922-17bc-4fb0-880c-be50cfc100dd
Splunk	This analytic correlates risk events between privileged account creation on Cisco IOS devices and HTTP requests to privileged execution paths such as `/level/15/exec/-/*`. (...)	Correlation	stable	-	-	Cisco	Persistence Create Account Lateral Movement Remote Services SSH Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Nasreddine Bencherchali, Splunk	2026-01-12	2026-05-13	2c9d4f5a-8b6e-4c7f-9d8e-1a2b3c4d5e6f
Splunk	This analytic detects a correlation between privileged account creation on Cisco IOS devices and sub (...)	Correlation	stable	-	-	Cisco	Persistence Create Account Lateral Movement Remote Services SSH Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Nasreddine Bencherchali, Splunk	2026-01-12	2026-05-13	7f8e2b4c-9a3d-4e1f-8c5b-6d7e8f9a0b1c
Splunk	This analytic detects inbound SSH connections to non-standard ports on network devices using Cisco Secure Firewall Intrusion Events. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Lateral Movement Remote Services SSH	-	medium	Nasreddine Bencherchali, Michael Haag, Splunk	2026-01-12	2026-05-13	9b0c2d3e-4f5a-6b7c-8d9e-0f1a2b3c4d5e
Splunk	This analytic detects inbound SSH connections to the sshd_operns service on network devices using Cisco Secure Firewall Intrusion Events. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Lateral Movement Remote Services SSH	-	medium	Nasreddine Bencherchali, Splunk	2026-01-12	2026-05-13	8a9c1d2e-3f4b-5c6d-7e8f-9a0b1c2d3e4f
Splunk	This detection identifies SSH being enabled on ESXi hosts, which can be an early indicator of malicious activity. (...)	Generic	stable	-	esxi	VMware ESXi · VMware	Lateral Movement Remote Services SSH	-	medium	Raven Tait, Splunk	2025-07-11	2026-05-13	b8003567-c5b6-445b-8966-ecdacc81c24d	-
Splunk	The following analytic detects the use of SSH to move laterally and execute a script or file on a remote host. (...)	Generic	stable	process_creation	linux	Sysmon	Lateral Movement Remote Services SSH	-	medium	Michael Haag, Splunk	2022-06-17	2026-05-13	aa1748dd-4a5c-457a-9cf6-ca7b4eb711b3
	Detects the OpenEDR ssh-shellhost.exe spawning a command shell (cmd.exe) or PowerShell with PTY (pseudo-terminal) capabilities. (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Command and Control Remote Access Tools Lateral Movement Remote Services SSH	-	medium	@kostastsale	2026-02-19	—	7f3a9c2d-4e8b-4a7f-9d3e-5c6f8a9b2e1d
	Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket.	Generic	test	-	windows	OpenSSH	Lateral Movement Remote Services SSH	-	medium	mdecrevoisier	2022-10-25	—	3ce8e9a4-bc61-4c9b-8e69-d7e2492a8781
	Detects port forwarding activity via SSH.exe	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Protocol Tunneling Lateral Movement Remote Services Remote Desktop Protocol SSH	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-10-12	2024-03-05	327f48c1-a6db-4eb8-875a-f6981f1b0183
	Detects suspicious UltraVNC command line flag combination that indicate a auto reconnect upon execution, e.g. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Lateral Movement Remote Services VNC	-	high	Bhabesh Raj	2022-03-04	2022-03-09	871b9555-69ca-4993-99d3-35a59f9f3599
Splunk	The following analytic detects SSH connections presenting client banners that do not match known, common SSH client software by leveraging Zeek ssh logs. (...)	Anomaly	stable	network_connection	-	Zeek	Command and Control Protocol Tunneling Lateral Movement Remote Services SSH	-	medium	Raven Tait, Splunk	2026-10-12	2026-10-12	93d0f598-d65f-4c97-b030-5bb0af51a226
Splunk	This analytic detects the use of Plink (including renamed versions like pvhost.exe) for protocol tunneling, which may be used for egress or lateral movement within an organization. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Command and Control Protocol Tunneling Lateral Movement Remote Services SSH	-	medium	Michael Haag, Splunk	2022-06-17	2026-05-13	8aac5e1e-0fab-4437-af0b-c6e60af23eed
Splunk	This analytic detects the execution of programs associated with the PuTTY SSH client suite, including putty.exe, pscp.exe, plink.exe, psftp.exe, and puttygen.exe. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Lateral Movement Remote Services SSH	-	medium	Raven Tait, Splunk	2026-05-05	2026-05-13	64d5263e-0f29-4641-81ed-03b39c27ecd4	-

Standing G0036

Title

Description