Microsoft Actinium February 2022

QuietSieve can collect files from a compromised host.

QuietSieve can check C2 connectivity with a `ping` to 8.8.8.8 (Google public DNS).

Gamaredon Group has used VNC tools, including UltraVNC, to remotely interact with compromised hosts.

Pteranodon can use a dynamic Windows hashing algorithm to map API components.

PowerPunch can use Base64-encoded scripts.

Gamaredon Group has used obfuscated or encrypted scripts.

Gamaredon Group has created scheduled tasks to launch executables after a designated number of minutes have passed.

PowerPunch has the ability to execute through PowerShell.

Gamaredon Group has used obfuscated PowerShell scripts for staging. Additionally, (LinkById : G0047) has used PowerShell based tools later in its attack chain. Additionally, Gamaredon Group has used the PowerShell cmdlet `Get-Command` to download and execute the next stage payload.

Gamaredon Group has embedded malicious macros in document templates, which executed VBScript. Gamaredon Group has also delivered Microsoft Outlook VBA projects with embedded macros. Additionally, Gamaredon Group has executed VBScript files using wscript.exe.

QuietSieve can use HTTPS in C2 communications.

QuietSieve can search files on the target host by extension, including doc, docx, xls, rtf, odt, txt, jpg, pdf, rar, zip, and 7z.

Gamaredon Group has downloaded additional malware and tools onto a compromised host. For example, Gamaredon Group uses a backdoor script to retrieve and decode additional payloads once in victim environments.

PowerPunch can download payloads from adversary infrastructure.

QuietSieve can download and execute payloads on a target host.

Pteranodon has used various API calls.

QuietSieve has taken screenshots every five minutes and saved them to the user's local Application Data folder under `Temp\SymbolSourceSymbols\icons` or `Temp\ModeAuto\icons`.

QuietSieve can identify and search removable drives for specific file name extensions.

QuietSieve can identify and search networked drives for specific file name extensions.

Pteranodon can decrypt encrypted data strings prior to using them.

Gamaredon Group has attempted to get users to click on Office attachments with malicious macros embedded. Gamaredon Group has also attempted to get users to click on thematically named files.

Gamaredon Group has used DOCX files to download malicious DOT document templates and has used RTF template injection to download malicious payloads. Gamaredon Group can also inject malicious macros or remote templates into documents already present on compromised systems.

PowerPunch can use the volume serial number from a target host to generate a unique XOR key for the next stage payload.

QuietSieve has the ability to execute payloads in a hidden window.

Gamaredon Group has delivered spearphishing emails with malicious attachments to targets. Additionally, Gamaredon Group has distributed malicious LNK files compressed in ZIP archives.

Gamaredon Group has registered multiple domains to facilitate payload staging and C2.

Gamaredon Group has registered domains to stage payloads.