Unit 42 Gamaredon February 2022

Gamaredon Group has used VNC tools, including UltraVNC, to remotely interact with compromised hosts.

Gamaredon Group has used legitimate process names to hide malware including svchosst. Additionally, Gamaredon Group disguised malicious ZIP archives as Office documents that are related to the invasion.

Gamaredon Group has used tools to enumerate processes on target hosts including Process Explorer.

Gamaredon Group has used various batch scripts to establish C2 and download additional files. Gamaredon Group's backdoor malware has also been written to a batch file.

Gamaredon Group has used HTTP and HTTPS for C2 communications.

Gamaredon Group macros can scan for Microsoft Word and Excel files to inject with additional malicious macros. Gamaredon Group has also used its backdoors to automatically list interesting files (such as Office documents) found on a system. Gamaredon Group has also identified directory trees, folders and files on the compromised host.

Pteranodon can download and execute additional files.

Pteranodon can capture screenshots at a configurable interval.

Gamaredon Group has attempted to get users to click on Office attachments with malicious macros embedded. Gamaredon Group has also attempted to get users to click on thematically named files.

Gamaredon Group has used DOCX files to download malicious DOT document templates and has used RTF template injection to download malicious payloads. Gamaredon Group can also inject malicious macros or remote templates into documents already present on compromised systems.

Pteranodon has the ability to use anti-detection functions to identify sandbox environments.

Gamaredon Group has used hidcon to run batch files in a hidden console window. Gamaredon Group has also executed PowerShell in a hidden window.

Gamaredon Group has delivered spearphishing emails with malicious attachments to targets. Additionally, Gamaredon Group has distributed malicious LNK files compressed in ZIP archives.

Gamaredon Group has incorporated dynamic DNS domains in its infrastructure.

Gamaredon Group has registered multiple domains to facilitate payload staging and C2.

Gamaredon Group has registered domains to stage payloads.