unit42_gamaredon_dec2022

Gamaredon Group has used obfuscated VBScripts with randomly generated variable names and concatenated strings.

Gamaredon Group has used WMI to execute scripts used for discovery and for determining the C2 IP address. Gamaredon Group has used the following WMI query to search for a ping record: `Select * From Win32_PingStatus where Address = 'mil.gov.ua'`.

Gamaredon Group has created scheduled tasks to launch executables after a designated number of minutes have passed.

Gamaredon Group has used HTTP and HTTPS for C2 communications.

Gamaredon Group has used Telegram Messenger content to discover the IP address for C2 communications.

Gamaredon Group has downloaded additional malware and tools onto a compromised host. For example, Gamaredon Group uses a backdoor script to retrieve and decode additional payloads once in victim environments.

Gamaredon Group tools decrypted additional payloads from the C2. Gamaredon Group has also decoded Base64-encoded source code of a downloader. Additionally, Gamaredon Group has decoded Telegram content to reveal the IP address for C2 communications.

Gamaredon Group has attempted to get users to click on a link pointing to a malicious HTML file leading to follow-on malicious content.

Gamaredon Group has attempted to get users to click on Office attachments with malicious macros embedded. Gamaredon Group has also attempted to get users to click on thematically named files.

Gamaredon Group has used `mshta.exe` to execute malicious files.

Gamaredon Group has used geoblocking to limit downloads of the malicious file to specific geographic locations.

Gamaredon Group tools have registered Run keys in the registry to give malicious VBS files persistence.

Gamaredon Group has delivered spearphishing emails with malicious attachments to targets. Additionally, Gamaredon Group has distributed malicious LNK files compressed in ZIP archives.

Gamaredon Group has used fast flux DNS to mask their command and control channel behind rotating IP addresses. Additionally, Gamaredon Group has used a low-frequency variant of the single-flux method.

Gamaredon Group has used VPS hosting providers for infrastructure outside of Russia.

Gamaredon Group has used various legitimate tools, such as `mshta.exe` and Reg, and services during operations.