Gamaredon Group
Gamaredon Group is a threat group that has been active since at least 2013 and has targeted individuals likely involved in the Ukrainian government. The name Gamaredon Group comes from a misspelling of the word "Armageddon", which was detected in the adversary's early campaigns.[1][2][3]
Techniques Used
Domain | ID | Name | Use | |
---|---|---|---|---|
Enterprise | T1071 | .001 | Application Layer Protocol: Web Protocols |
A Gamaredon Group file stealer can communicate over HTTP for C2.[1][2][3] |
Enterprise | T1119 | Automated Collection |
Gamaredon Group has deployed scripts on compromised systems that automatically scan for interesting documents.[3] |
|
Enterprise | T1020 | Automated Exfiltration |
Gamaredon Group has used modules that automatically upload gathered documents to the C2 server.[3] |
|
Enterprise | T1547 | .001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
Gamaredon Group tools have registered Run keys in the registry to give malicious VBS files persistence.[2][3] |
Enterprise | T1059 | .003 | Command and Scripting Interpreter: Windows Command Shell |
Gamaredon Group has used various batch scripts to establish C2 and download additional files. Gamaredon Group's backdoor malware has also been written to a batch file.[1][3] |
.005 | Command and Scripting Interpreter: Visual Basic |
Gamaredon Group has embedded malicious macros in document templates, which executed VBScript. Gamaredon Group has also delivered Microsoft Outlook VBA projects with embedded macros.[2][3] |
||
Enterprise | T1005 | Data from Local System |
Gamaredon Group has collected files from infected systems and uploaded them to a C2 server.[3] |
|
Enterprise | T1039 | Data from Network Shared Drive |
Gamaredon Group malware has collected Microsoft Office documents from mapped network drives.[3] |
|
Enterprise | T1025 | Data from Removable Media |
A Gamaredon Group file stealer has the capability to steal data from newly connected logical volumes on a system, including USB drives.[1][3] |
|
Enterprise | T1140 | Deobfuscate/Decode Files or Information |
Gamaredon Group tools decrypted additional payloads from the C2. Gamaredon Group has also decoded base64-encoded source code of a downloader.[2][3] |
|
Enterprise | T1041 | Exfiltration Over C2 Channel |
A Gamaredon Group file stealer can transfer collected files to a hardcoded C2 server.[1] |
|
Enterprise | T1083 | File and Directory Discovery |
Gamaredon Group macros can scan for Microsoft Word and Excel files to inject with additional malicious macros. Gamaredon Group has also used its backdoors to automatically list interesting files (such as Office documents) found on a system.[3] |
|
Enterprise | T1562 | .001 | Impair Defenses: Disable or Modify Tools |
Gamaredon Group has delivered macros which can tamper with Microsoft Office security settings.[3] |
Enterprise | T1070 | .004 | Indicator Removal on Host: File Deletion |
Gamaredon Group tools can delete files used during an infection.[2] |
Enterprise | T1105 | Ingress Tool Transfer |
Tools used by Gamaredon Group are capable of downloading and executing additional payloads.[1][2][3] |
|
Enterprise | T1559 | .001 | Inter-Process Communication: Component Object Model |
Gamaredon Group malware can insert malicious macros into documents using a |
Enterprise | T1534 | Internal Spearphishing |
Gamaredon Group has used an Outlook VBA module on infected systems to send phishing emails with malicious attachments to other employees within the organization.[3] |
|
Enterprise | T1112 | Modify Registry |
Gamaredon Group has removed security settings for VBA macro execution by changing registry values |
|
Enterprise | T1106 | Native API |
Gamaredon Group malware has used |
|
Enterprise | T1027 | Obfuscated Files or Information |
Gamaredon Group has delivered self-extracting 7z archive files within malicious document attachments, and used obfuscated or encrypted scripts.[3] |
|
.004 | Compile After Delivery |
Gamaredon Group has compiled the source code for a downloader directly on the infected system using the built-in |
||
.001 | Binary Padding |
Gamaredon Group has obfuscated .NET executables by inserting junk code.[3] |
||
Enterprise | T1137 | Office Application Startup |
Gamaredon Group has inserted malicious macros into existing documents, providing persistence when they are reopened. Gamaredon Group has loaded the group's previously delivered VBA project by relaunching Microsoft Outlook with the |
|
Enterprise | T1120 | Peripheral Device Discovery |
Gamaredon Group tools have contained an application to check performance of USB flash drives. Gamaredon Group has also used malware to scan for removable drives.[1][3] |
|
Enterprise | T1566 | .001 | Phishing: Spearphishing Attachment |
Gamaredon Group has delivered spearphishing emails with malicious attachments to targets.[2][3] |
Enterprise | T1053 | .005 | Scheduled Task/Job: Scheduled Task |
Gamaredon Group has created a scheduled task to launch an executable every 10 minutes.[3] |
Enterprise | T1113 | Screen Capture |
Gamaredon Group's malware can take screenshots of the compromised computer every minute.[3] |
|
Enterprise | T1218 | .011 | Signed Binary Proxy Execution: Rundll32 |
Gamaredon Group malware has used rundll32 to launch additional malicious components.[3] |
Enterprise | T1082 | System Information Discovery |
A Gamaredon Group file stealer can gather the victim's computer name and drive serial numbers to send to a C2 server.[1][2] |
|
Enterprise | T1033 | System Owner/User Discovery |
A Gamaredon Group file stealer can gather the victim's username to send to a C2 server.[1] |
|
Enterprise | T1080 | Taint Shared Content |
Gamaredon Group has injected malicious macros into all Word and Excel documents on mapped network drives.[3] |
|
Enterprise | T1221 | Template Injection |
Gamaredon Group has used DOCX files to download malicious DOT document templates. Gamaredon Group can also inject malicious macros or remote templates into documents already present on compromised systems.[2][3] |
|
Enterprise | T1204 | .002 | User Execution: Malicious File |
Gamaredon Group has attempted to get users to click on Office attachments with malicious macros embedded.[2][3] |
Enterprise | T1102 | Web Service |
Gamaredon Group has used GitHub repositories for downloaders which will be obtained by the group's .NET executable on the compromised system.[3] |