Procedure examples

Gamaredon Group has left taunting images and messages on the victims' desktops as proof of system access.

Gamaredon Group has checked existing conditions, such as geographic location, device type, or system specification, before the victim is sent a malicious Word document.

Gamaredon Group has used PowerShell scripts to identify security software on the victim machine.

Gamaredon Group has used an Outlook VBA module on infected systems to send phishing emails with malicious attachments to other employees within the organization.

Gamaredon Group tools have registered Run keys in the registry to give malicious VBS files persistence.

Gamaredon Group malware can insert malicious macros into documents using a Microsoft.Office.Interop object.

Gamaredon Group has used tools to delete files and folders from victims' desktops and profiles.

Gamaredon Group has used hidcon to run batch files in a hidden console window. Gamaredon Group has also executed PowerShell in a hidden window.

Gamaredon Group has delivered spearphishing emails with malicious attachments to targets. Additionally, Gamaredon Group has distributed malicious LNK files compressed in ZIP archives.

Gamaredon Group has incorporated dynamic DNS domains in its infrastructure.

Gamaredon Group has used fast flux DNS to mask their command and control channel behind rotating IP addresses. Additionally, Gamaredon Group has used a low-frequency variant of the single-flux method.

Gamaredon Group has used port 6856 for C2 communications.

Gamaredon Group has registered multiple domains to facilitate payload staging and C2.

Gamaredon Group has used VPS hosting providers for infrastructure outside of Russia.

Gamaredon Group has used Cloudflare’s TryClouldflare service to obtain C2 nodes.

Gamaredon Group has used the same TLS certificate across its infrastructure.

Gamaredon Group has used various legitimate tools, such as `mshta.exe` and Reg, and services during operations.

Gamaredon Group has registered domains to stage payloads.

Gamaredon Group has used an obfuscated PowerShell script that used `System.Reflection.Assembly` to gather and send victim information to the C2.

Gamaredon Group has delivered macros which can tamper with Microsoft Office security settings.