Gamaredon Group

Gamaredon Group is a threat group that has been active since at least 2013 and has targeted individuals likely involved in the Ukrainian government. The name Gamaredon Group comes from a misspelling of the word "Armageddon", which was detected in the adversary's early campaigns.[1][2][3]

ID: G0047
Contributors: ESET; Trend Micro Incorporated
Version: 1.2
Created: 31 May 2017
Last Modified: 20 January 2021

Techniques Used

Domain ID Name Use
Enterprise T1071 .001 Application Layer Protocol: Web Protocols

A Gamaredon Group file stealer can communicate over HTTP for C2.[1][2][3]

Enterprise T1119 Automated Collection

Gamaredon Group has deployed scripts on compromised systems that automatically scan for interesting documents.[3]

Enterprise T1020 Automated Exfiltration

Gamaredon Group has used modules that automatically upload gathered documents to the C2 server.[3]

Enterprise T1547 .001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Gamaredon Group tools have registered Run keys in the registry to give malicious VBS files persistence.[2][3]

Enterprise T1059 .003 Command and Scripting Interpreter: Windows Command Shell

Gamaredon Group has used various batch scripts to establish C2 and download additional files. Gamaredon Group's backdoor malware has also been written to a batch file.[1][3]

.005 Command and Scripting Interpreter: Visual Basic

Gamaredon Group has embedded malicious macros in document templates, which executed VBScript. Gamaredon Group has also delivered Microsoft Outlook VBA projects with embedded macros.[2][3]

Enterprise T1005 Data from Local System

Gamaredon Group has collected files from infected systems and uploaded them to a C2 server.[3]

Enterprise T1039 Data from Network Shared Drive

Gamaredon Group malware has collected Microsoft Office documents from mapped network drives.[3]

Enterprise T1025 Data from Removable Media

A Gamaredon Group file stealer has the capability to steal data from newly connected logical volumes on a system, including USB drives.[1][3]

Enterprise T1140 Deobfuscate/Decode Files or Information

Gamaredon Group tools decrypted additional payloads from the C2. Gamaredon Group has also decoded base64-encoded source code of a downloader.[2][3]

Enterprise T1041 Exfiltration Over C2 Channel

A Gamaredon Group file stealer can transfer collected files to a hardcoded C2 server.[1]

Enterprise T1083 File and Directory Discovery

Gamaredon Group macros can scan for Microsoft Word and Excel files to inject with additional malicious macros. Gamaredon Group has also used its backdoors to automatically list interesting files (such as Office documents) found on a system.[3]

Enterprise T1562 .001 Impair Defenses: Disable or Modify Tools

Gamaredon Group has delivered macros which can tamper with Microsoft Office security settings.[3]

Enterprise T1070 .004 Indicator Removal on Host: File Deletion

Gamaredon Group tools can delete files used during an infection.[2]

Enterprise T1105 Ingress Tool Transfer

Tools used by Gamaredon Group are capable of downloading and executing additional payloads.[1][2][3]

Enterprise T1559 .001 Inter-Process Communication: Component Object Model

Gamaredon Group malware can insert malicious macros into documents using a Microsoft.Office.Interop object.[3]

Enterprise T1534 Internal Spearphishing

Gamaredon Group has used an Outlook VBA module on infected systems to send phishing emails with malicious attachments to other employees within the organization.[3]

Enterprise T1112 Modify Registry

Gamaredon Group has removed security settings for VBA macro execution by changing registry values HKCU\Software\Microsoft\Office\<version>\<product>\Security\VBAWarnings and HKCU\Software\Microsoft\Office\<version>\<product>\Security\AccessVBOM.[3]

Enterprise T1106 Native API

Gamaredon Group malware has used CreateProcess to launch additional malicious components.[3]

Enterprise T1027 Obfuscated Files or Information

Gamaredon Group has delivered self-extracting 7z archive files within malicious document attachments, and used obfuscated or encrypted scripts.[3]

.001 Binary Padding

Gamaredon Group has obfuscated .NET executables by inserting junk code.[3]

.004 Compile After Delivery

Gamaredon Group has compiled the source code for a downloader directly on the infected system using the built-in Microsoft.CSharp.CSharpCodeProvider class.[3]

Enterprise T1137 Office Application Startup

Gamaredon Group has inserted malicious macros into existing documents, providing persistence when they are reopened. Gamaredon Group has loaded the group's previously delivered VBA project by relaunching Microsoft Outlook with the /altvba option, once the Application.Startup event is received.[3]

Enterprise T1120 Peripheral Device Discovery

Gamaredon Group tools have contained an application to check performance of USB flash drives. Gamaredon Group has also used malware to scan for removable drives.[1][3]

Enterprise T1566 .001 Phishing: Spearphishing Attachment

Gamaredon Group has delivered spearphishing emails with malicious attachments to targets.[2][3]

Enterprise T1053 .005 Scheduled Task/Job: Scheduled Task

Gamaredon Group has created a scheduled task to launch an executable every 10 minutes.[3]

Enterprise T1113 Screen Capture

Gamaredon Group's malware can take screenshots of the compromised computer every minute.[3]

Enterprise T1218 .011 Signed Binary Proxy Execution: Rundll32

Gamaredon Group malware has used rundll32 to launch additional malicious components.[3]

Enterprise T1082 System Information Discovery

A Gamaredon Group file stealer can gather the victim's computer name and drive serial numbers to send to a C2 server.[1][2]

Enterprise T1033 System Owner/User Discovery

A Gamaredon Group file stealer can gather the victim's username to send to a C2 server.[1]

Enterprise T1080 Taint Shared Content

Gamaredon Group has injected malicious macros into all Word and Excel documents on mapped network drives.[3]

Enterprise T1221 Template Injection

Gamaredon Group has used DOCX files to download malicious DOT document templates. Gamaredon Group can also inject malicious macros or remote templates into documents already present on compromised systems.[2][3]

Enterprise T1204 .002 User Execution: Malicious File

Gamaredon Group has attempted to get users to click on Office attachments with malicious macros embedded.[2][3]

Enterprise T1102 Web Service

Gamaredon Group has used GitHub repositories for downloaders which will be obtained by the group's .NET executable on the compromised system.[3]

Software

ID Name References Techniques
S0147 Pteranodon [1] Application Layer Protocol: Web Protocols, Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Command and Scripting Interpreter: Windows Command Shell, Data Staged: Local Data Staging, Exfiltration Over C2 Channel, File and Directory Discovery, Indicator Removal on Host: File Deletion, Ingress Tool Transfer, Scheduled Task/Job: Scheduled Task, Screen Capture, Signed Binary Proxy Execution: Rundll32

References