Gamaredon Group

Gamaredon Group has deployed scripts on compromised systems that automatically scan for interesting documents.^[3]

Gamaredon Group has used modules that automatically upload gathered documents to the C2 server.^[3]

Gamaredon Group has collected files from infected systems and uploaded them to a C2 server.^[3][10]

Gamaredon Group malware has collected Microsoft Office documents from mapped network drives.^[3][10]

A Gamaredon Group file stealer has the capability to steal data from newly connected logical volumes on a system, including USB drives.^[1][3][10]

Gamaredon Group has used obfuscated VBScripts with randomly generated variable names and concatenated strings.^[12]

Gamaredon Group tools decrypted additional payloads from the C2. Gamaredon Group has also decoded Base64-encoded source code of a downloader.^[2][3][10] Additionally, Gamaredon Group has decoded Telegram content to reveal the IP address for C2 communications.^[12]

Gamaredon Group has incorporated dynamic DNS domains in its infrastructure.^[8]

Gamaredon Group has used geoblocking to limit downloads of the malicious file to specific geographic locations.^[12][15]

A Gamaredon Group file stealer can transfer collected files to a hardcoded C2 server.^[1][10][11]

Gamaredon Group macros can scan for Microsoft Word and Excel files to inject with additional malicious macros. Gamaredon Group has also used its backdoors to automatically list interesting files (such as Office documents) found on a system.^[3][8][10] Gamaredon Group has also identified directory trees, folders and files on the compromised host.^[11]

Gamaredon Group has downloaded additional malware and tools onto a compromised host.^{[1][2][3][5][10][15]} For example, Gamaredon Group uses a backdoor script to retrieve and decode additional payloads once in victim environments.^[12]

Gamaredon Group has used an Outlook VBA module on infected systems to send phishing emails with malicious attachments to other employees within the organization.^[3]

Gamaredon Group has removed security settings for VBA macro execution by changing registry values HKCU\Software\Microsoft\Office\<version>\<product>\Security\VBAWarnings and HKCU\Software\Microsoft\Office\<version>\<product>\Security\AccessVBOM.^[3][14][10] Gamaredon Group has also modified Registry keys to hide folders and system files and to add the C2 address under HKEY_CURRENT_USER\Console\WindowsUpdate. ^[11]

Gamaredon Group malware has used CreateProcess to launch additional malicious components.^[3][10]

Gamaredon Group has used SOCKS5 over port 9050 for C2 communication.^[11]

Gamaredon Group has used port 6856 for C2 communications.^[15]

Gamaredon Group has delivered self-extracting 7z archive files within malicious document attachments.^[3] Additionally, Gamaredon Group has used an obfuscated .drv file.^[11]

Gamaredon Group has inserted malicious macros into existing documents, providing persistence when they are reopened. Gamaredon Group has loaded the group's previously delivered VBA project by relaunching Microsoft Outlook with the /altvba option, once the Application.Startup event is received.^[3]

Gamaredon Group tools have contained an application to check performance of USB flash drives. Gamaredon Group has also used malware to scan for removable drives.^[1][3][10]

Gamaredon Group has used tools to enumerate processes on target hosts including Process Explorer.^[4][8][11]

Gamaredon Group has injected Remcos into explorer.exe.^[15]

Gamaredon Group has used the Cloudflare Tunnel client to proxy C2 traffic.^[10]

Gamaredon Group has queried HKEY_CURRENT_USER\\Console\\WindowsUpdates to obtain the C2 addresses.^[11] Gamaredon Group has queried HKEY_CURRENT_USER\\Console\\WindowsUpdates to obtain the C2 addresses.^[11]

Gamaredon Group has used an obfuscated PowerShell script that used System.Reflection.Assembly to gather and send victim information to the C2.^[11]

Gamaredon Group has replicated to removable media by leveraging the User Assist Reg Key and creating LNKs on all network and removable drives available on the infected host.^[11]

Gamaredon Group's malware can take screenshots of the compromised computer every minute.^[3][11][10]

A Gamaredon Group file stealer can gather the victim's computer name and drive serial numbers to send to a C2 server.^{[1][2][14][11][10]}

A Gamaredon Group file stealer can gather the victim's username to send to a C2 server.^[1]

Gamaredon Group has injected malicious macros into all Word and Excel documents on mapped network drives.^[3]

Gamaredon Group has used DOCX files to download malicious DOT document templates and has used RTF template injection to download malicious payloads.^[17] Gamaredon Group can also inject malicious macros or remote templates into documents already present on compromised systems.^{[2][3][14][5][8][7][10]}

Gamaredon Group has used GitHub repositories for downloaders which will be obtained by the group's .NET executable on the compromised system.^[3]

Gamaredon Group has used WMI to execute scripts used for discovery and for determining the C2 IP address.^{[14][12][11][10]} Gamaredon Group has used the following WMI query to search for a ping record: Select * From Win32_PingStatus where Address = 'mil.gov.ua'.^[11]