ESET Gamaredon Sept2024

Gamaredon Group has collected files from infected systems and uploaded them to a C2 server.

A Gamaredon Group file stealer has the capability to steal data from newly connected logical volumes on a system, including USB drives.

Gamaredon Group has used obfuscated or encrypted scripts.

Gamaredon Group malware has collected Microsoft Office documents from mapped network drives.

A Gamaredon Group file stealer can transfer collected files to a hardcoded C2 server.

Gamaredon Group has used WMI to execute scripts used for discovery and for determining the C2 IP address. Gamaredon Group has used the following WMI query to search for a ping record: `Select * From Win32_PingStatus where Address = 'mil.gov.ua'`.

Gamaredon Group has used obfuscated PowerShell scripts for staging. Additionally, (LinkById : G0047) has used PowerShell based tools later in its attack chain. Additionally, Gamaredon Group has used the PowerShell cmdlet `Get-Command` to download and execute the next stage payload.

Gamaredon Group has embedded malicious macros in document templates, which executed VBScript. Gamaredon Group has also delivered Microsoft Outlook VBA projects with embedded macros. Additionally, Gamaredon Group has executed VBScript files using wscript.exe.

Gamaredon Group tools can delete files used during an operation.

Gamaredon Group has used HTTP and HTTPS for C2 communications.

A Gamaredon Group file stealer can gather the victim's computer name and drive serial numbers to send to a C2 server.

Gamaredon Group macros can scan for Microsoft Word and Excel files to inject with additional malicious macros. Gamaredon Group has also used its backdoors to automatically list interesting files (such as Office documents) found on a system. Gamaredon Group has also identified directory trees, folders and files on the compromised host.

Gamaredon Group has used the Cloudflare Tunnel client to proxy C2 traffic.

Gamaredon Group has used several ways to try to resolve the C2 server, including: public third-party websites, an adversary-operated Telegraph channel, the ngrok utility and the TXT record of a hardcoded C2 domain.

Gamaredon Group has downloaded additional malware and tools onto a compromised host. For example, Gamaredon Group uses a backdoor script to retrieve and decode additional payloads once in victim environments.

Gamaredon Group malware has used CreateProcess to launch additional malicious components.

Gamaredon Group has removed security settings for VBA macro execution by changing registry values HKCU\Software\Microsoft\Office\<version>\<product>\Security\VBAWarnings and HKCU\Software\Microsoft\Office\<version>\<product>\Security\AccessVBOM. Gamaredon Group has also modified Registry keys to hide folders and system files and to add the C2 address under `HKEY_CURRENT_USER\Console\WindowsUpdate`.

Gamaredon Group's malware can take screenshots of the compromised computer every minute.

Gamaredon Group tools have contained an application to check performance of USB flash drives. Gamaredon Group has also used malware to scan for removable drives.

Gamaredon Group tools decrypted additional payloads from the C2. Gamaredon Group has also decoded Base64-encoded source code of a downloader. Additionally, Gamaredon Group has decoded Telegram content to reveal the IP address for C2 communications.

Gamaredon Group has attempted to get users to click on a link pointing to a malicious HTML file leading to follow-on malicious content.

Gamaredon Group has used `mshta.exe` to execute malicious files.

Gamaredon Group has used DOCX files to download malicious DOT document templates and has used RTF template injection to download malicious payloads. Gamaredon Group can also inject malicious macros or remote templates into documents already present on compromised systems.

Gamaredon Group tools have registered Run keys in the registry to give malicious VBS files persistence.

Gamaredon Group malware can insert malicious macros into documents using a Microsoft.Office.Interop object.

Gamaredon Group has delivered spearphishing emails with malicious attachments to targets. Additionally, Gamaredon Group has distributed malicious LNK files compressed in ZIP archives.

Gamaredon Group has used fast flux DNS to mask their command and control channel behind rotating IP addresses. Additionally, Gamaredon Group has used a low-frequency variant of the single-flux method.

Gamaredon Group has registered multiple domains to facilitate payload staging and C2.

Gamaredon Group has used VPS hosting providers for infrastructure outside of Russia.

Gamaredon Group has used various legitimate tools, such as `mshta.exe` and Reg, and services during operations.

Gamaredon Group has delivered macros which can tamper with Microsoft Office security settings.