APT / THREAT GROUP

GIMMICK

aliases

Last seen:Mar 17, 2026

Intelligence Profile

This multi-platform malware is a ObjectiveC written macOS variant dubbed GIMMICK by Volexity. This malware is a file-based C2 implant used by Storm Cloud.

Threat Analysis

GIMMICK is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→http://stillu.cc/assets/slides/2023-08-Unmasking%20CamoFei.pdf

→https://hitcon.org/2023/CMT/slide/Unmasking%20CamoFei_An%20In-depth%20Analysis%20of%20an%20Emerging%20APT%20Group%20Focused%20on%20Healthcare%20Sectors%20in%20East%20Asia.pdf

→https://www.volexity.com/blog/2022/03/22/storm-cloud-on-the-horizon-gimmick-malware-strikes-at-macos/

Quick Facts

TypeAPT / Threat Group

Aliases3

Also Known As

GIMMICKosx.gimmickwin.gimmick

External Intelligence

Malpedia: win.gimmick

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search GIMMICK