Procedure examples

Gamaredon Group has used obfuscated VBScripts with randomly generated variable names and concatenated strings.

Gamaredon Group has collected files from infected systems and uploaded them to a C2 server.

Gamaredon Group has queried ` HKEY_CURRENT_USER\\Console\\WindowsUpdates` to obtain the C2 addresses. Gamaredon Group has queried ` HKEY_CURRENT_USER\\Console\\WindowsUpdates` to obtain the C2 addresses.

Gamaredon Group has tested connectivity between a compromised machine and a C2 server using Ping with commands such as `CSIDL_SYSTEM\cmd.exe /c ping -n 1`. Gamaredon Group has searched the ping records to obtain the C2 address and has used ping to search for the C2’s status.

Gamaredon Group has used modules that automatically upload gathered documents to the C2 server.

Gamaredon Group has used VNC tools, including UltraVNC, to remotely interact with compromised hosts.

A Gamaredon Group file stealer has the capability to steal data from newly connected logical volumes on a system, including USB drives.

Gamaredon Group has delivered self-extracting 7z archive files within malicious document attachments. Additionally, Gamaredon Group has used an obfuscated .drv file.

Gamaredon Group has compiled the source code for a downloader directly on the infected system using the built-in Microsoft.CSharp.CSharpCodeProvider class.

Gamaredon Group has used obfuscated or encrypted scripts.

Gamaredon Group has used LNK files to hide malicious scripts for execution.

Gamaredon Group has delivered malicious payloads within compressed archives and zip files.

Gamaredon Group has obfuscated .NET executables by inserting junk code.

A Gamaredon Group file stealer can gather the victim's username to send to a C2 server.

Gamaredon Group has used legitimate process names to hide malware including svchosst. Additionally, Gamaredon Group disguised malicious ZIP archives as Office documents that are related to the invasion.

Gamaredon Group malware has collected Microsoft Office documents from mapped network drives.

A Gamaredon Group file stealer can transfer collected files to a hardcoded C2 server.

Gamaredon Group has used WMI to execute scripts used for discovery and for determining the C2 IP address. Gamaredon Group has used the following WMI query to search for a ping record: `Select * From Win32_PingStatus where Address = 'mil.gov.ua'`.

Gamaredon Group has created scheduled tasks to launch executables after a designated number of minutes have passed.

Gamaredon Group has injected Remcos into explorer.exe.

Gamaredon Group has used tools to enumerate processes on target hosts including Process Explorer.

Gamaredon Group has used obfuscated PowerShell scripts for staging. Additionally, (LinkById : G0047) has used PowerShell based tools later in its attack chain. Additionally, Gamaredon Group has used the PowerShell cmdlet `Get-Command` to download and execute the next stage payload.

Gamaredon Group has used various batch scripts to establish C2 and download additional files. Gamaredon Group's backdoor malware has also been written to a batch file.

Gamaredon Group has embedded malicious macros in document templates, which executed VBScript. Gamaredon Group has also delivered Microsoft Outlook VBA projects with embedded macros. Additionally, Gamaredon Group has executed VBScript files using wscript.exe.

Gamaredon Group tools can delete files used during an operation.

Gamaredon Group has used HTTP and HTTPS for C2 communications.

Gamaredon Group has injected malicious macros into all Word and Excel documents on mapped network drives.

A Gamaredon Group file stealer can gather the victim's computer name and drive serial numbers to send to a C2 server.

Gamaredon Group macros can scan for Microsoft Word and Excel files to inject with additional malicious macros. Gamaredon Group has also used its backdoors to automatically list interesting files (such as Office documents) found on a system. Gamaredon Group has also identified directory trees, folders and files on the compromised host.

Gamaredon Group has used the Cloudflare Tunnel client to proxy C2 traffic.

Gamaredon Group has used Tor for C2 traffic.

Gamaredon Group has replicated to removable media by leveraging the User Assist Reg Key and creating LNKs on all network and removable drives available on the infected host.

Gamaredon Group has used SOCKS5 over port 9050 for C2 communication.

Gamaredon Group has used GitHub repositories for downloaders which will be obtained by the group's .NET executable on the compromised system.

Gamaredon Group has used several ways to try to resolve the C2 server, including: public third-party websites, an adversary-operated Telegraph channel, the ngrok utility and the TXT record of a hardcoded C2 domain.

Gamaredon Group has used Telegram Messenger content to discover the IP address for C2 communications.

Gamaredon Group has downloaded additional malware and tools onto a compromised host. For example, Gamaredon Group uses a backdoor script to retrieve and decode additional payloads once in victim environments.

Gamaredon Group malware has used CreateProcess to launch additional malicious components.

Gamaredon Group has removed security settings for VBA macro execution by changing registry values HKCU\Software\Microsoft\Office\<version>\<product>\Security\VBAWarnings and HKCU\Software\Microsoft\Office\<version>\<product>\Security\AccessVBOM. Gamaredon Group has also modified Registry keys to hide folders and system files and to add the C2 address under `HKEY_CURRENT_USER\Console\WindowsUpdate`.

Gamaredon Group's malware can take screenshots of the compromised computer every minute.

Gamaredon Group has deployed scripts on compromised systems that automatically scan for interesting documents.

Gamaredon Group tools have contained an application to check performance of USB flash drives. Gamaredon Group has also used malware to scan for removable drives.

Gamaredon Group has inserted malicious macros into existing documents, providing persistence when they are reopened. Gamaredon Group has loaded the group's previously delivered VBA project by relaunching Microsoft Outlook with the /altvba option, once the Application.Startup event is received.

Gamaredon Group tools decrypted additional payloads from the C2. Gamaredon Group has also decoded Base64-encoded source code of a downloader. Additionally, Gamaredon Group has decoded Telegram content to reveal the IP address for C2 communications.

Gamaredon Group has attempted to get users to click on a link pointing to a malicious HTML file leading to follow-on malicious content.

Gamaredon Group has attempted to get users to click on Office attachments with malicious macros embedded. Gamaredon Group has also attempted to get users to click on thematically named files.

Gamaredon Group has used `mshta.exe` to execute malicious files.

Gamaredon Group malware has used rundll32 to launch additional malicious components.

Gamaredon Group has used DOCX files to download malicious DOT document templates and has used RTF template injection to download malicious payloads. Gamaredon Group can also inject malicious macros or remote templates into documents already present on compromised systems.

Gamaredon Group has used geoblocking to limit downloads of the malicious file to specific geographic locations.