Cервис управления информационной безопасностью
Cервис управления информационной безопасностью
Вход Регистрация
MITRE ATT&CK - Преступная группа Gamaredon Group
CVE уязвимости
БДУ ФСТЭК уязвимости
НКЦКИ уязвимости
MITRE ATT&CK
БДУ ФСТЭК
Новая БДУ ФСТЭК
Риски
Каталоги
MITRE ATT&CK
Преступная группа
Gamaredon Group
Куда я попал?
SECURITM это SGRC система, ? автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.
Подробнее
Наш канал

Gamaredon Group

Gamaredon Group is a suspected Russian cyber espionage threat group that has targeted military, NGO, judiciary, law enforcement, and non-profit organizations in Ukraine since at least 2013. The name Gamaredon Group comes from a misspelling of the word "Armageddon", which was detected in the adversary's early campaigns.(Citation: Palo Alto Gamaredon Feb 2017)(Citation: TrendMicro Gamaredon April 2020)(Citation: ESET Gamaredon June 2020)(Citation: Symantec Shuckworm January 2022)(Citation: Microsoft Actinium February 2022) In November 2021, the Ukrainian government publicly attributed Gamaredon Group to Russia's Federal Security Service (FSB) Center 18.(Citation: Bleepingcomputer Gamardeon FSB November 2021)(Citation: Microsoft Actinium February 2022)
ID: G0047
Associated Groups: ACTINIUM, DEV-0157, IRON TILDEN, Armageddon, Shuckworm, Primitive Bear
Version: 2.0
Created: 31 May 2017
Last Modified: 15 Apr 2022

Associated Group Descriptions
Name Description
ACTINIUM (Citation: Microsoft Actinium February 2022)
DEV-0157 (Citation: Microsoft Actinium February 2022)
IRON TILDEN (Citation: Secureworks IRON TILDEN Profile)
Armageddon (Citation: Symantec Shuckworm January 2022)
Shuckworm (Citation: Symantec Shuckworm January 2022)
Primitive Bear (Citation: Unit 42 Gamaredon February 2022)

Techniques Used
Domain ID Name Use
Enterprise T1583 .001 Acquire Infrastructure: Domains

Gamaredon Group has registered multiple domains to facilitate payload staging and C2.(Citation: Microsoft Actinium February 2022)(Citation: Unit 42 Gamaredon February 2022)
Enterprise T1071 .001 Application Layer Protocol: Web Protocols

Gamaredon Group has used HTTP and HTTPS for C2 communications.(Citation: Palo Alto Gamaredon Feb 2017)(Citation: TrendMicro Gamaredon April 2020)(Citation: ESET Gamaredon June 2020)(Citation: Symantec Shuckworm January 2022)(Citation: CERT-EE Gamaredon January 2021)(Citation: Unit 42 Gamaredon February 2022)
Enterprise T1547 .001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Gamaredon Group tools have registered Run keys in the registry to give malicious VBS files persistence.(Citation: TrendMicro Gamaredon April 2020)(Citation: ESET Gamaredon June 2020)(Citation: CERT-EE Gamaredon January 2021)
Enterprise T1059 .001 Command and Scripting Interpreter: PowerShell

Gamaredon Group has used obfuscated PowerShell scripts for staging.(Citation: Microsoft Actinium February 2022)
.003 Command and Scripting Interpreter: Windows Command Shell

Gamaredon Group has used various batch scripts to establish C2 and download additional files. Gamaredon Group's backdoor malware has also been written to a batch file.(Citation: Palo Alto Gamaredon Feb 2017)(Citation: ESET Gamaredon June 2020)(Citation: CERT-EE Gamaredon January 2021)(Citation: Unit 42 Gamaredon February 2022)

.005 Command and Scripting Interpreter: Visual Basic

Gamaredon Group has embedded malicious macros in document templates, which executed VBScript. Gamaredon Group has also delivered Microsoft Outlook VBA projects with embedded macros.(Citation: TrendMicro Gamaredon April 2020)(Citation: ESET Gamaredon June 2020)(Citation: CERT-EE Gamaredon January 2021)(Citation: Microsoft Actinium February 2022)(Citation: Secureworks IRON TILDEN Profile)

Enterprise T1491 .001 Defacement: Internal Defacement

Gamaredon Group has left taunting images and messages on the victims' desktops as proof of system access.(Citation: CERT-EE Gamaredon January 2021)
Enterprise T1564 .003 Hide Artifacts: Hidden Window

Gamaredon Group has used hidcon to run batch files in a hidden console window.(Citation: Unit 42 Gamaredon February 2022)
Enterprise T1562 .001 Impair Defenses: Disable or Modify Tools

Gamaredon Group has delivered macros which can tamper with Microsoft Office security settings.(Citation: ESET Gamaredon June 2020)

Enterprise T1070 .004 Indicator Removal: File Deletion

Gamaredon Group tools can delete files used during an operation.(Citation: TrendMicro Gamaredon April 2020)(Citation: Symantec Shuckworm January 2022)(Citation: CERT-EE Gamaredon January 2021)
Enterprise T1559 .001 Inter-Process Communication: Component Object Model

Gamaredon Group malware can insert malicious macros into documents using a Microsoft.Office.Interop object.(Citation: ESET Gamaredon June 2020)

Enterprise T1036 .005 Masquerading: Match Legitimate Name or Location

Gamaredon Group has used legitimate process names to hide malware including svchosst.(Citation: Unit 42 Gamaredon February 2022)
Enterprise T1027 .001 Obfuscated Files or Information: Binary Padding

Gamaredon Group has obfuscated .NET executables by inserting junk code.(Citation: ESET Gamaredon June 2020)

.004 Obfuscated Files or Information: Compile After Delivery

Gamaredon Group has compiled the source code for a downloader directly on the infected system using the built-in Microsoft.CSharp.CSharpCodeProvider class.(Citation: ESET Gamaredon June 2020)

Enterprise T1566 .001 Phishing: Spearphishing Attachment

Gamaredon Group has delivered spearphishing emails with malicious attachments to targets.(Citation: TrendMicro Gamaredon April 2020)(Citation: ESET Gamaredon June 2020)(Citation: CERT-EE Gamaredon January 2021)(Citation: Microsoft Actinium February 2022)(Citation: Unit 42 Gamaredon February 2022)(Citation: Secureworks IRON TILDEN Profile)
Enterprise T1021 .005 Remote Services: VNC

Gamaredon Group has used VNC tools, including UltraVNC, to remotely interact with compromised hosts.(Citation: Symantec Shuckworm January 2022)(Citation: Microsoft Actinium February 2022)(Citation: Unit 42 Gamaredon February 2022)
Enterprise T1053 .005 Scheduled Task/Job: Scheduled Task

Gamaredon Group has created scheduled tasks to launch executables after a designated number of minutes have passed.(Citation: ESET Gamaredon June 2020)(Citation: CERT-EE Gamaredon January 2021)(Citation: Microsoft Actinium February 2022)

Enterprise T1608 .001 Stage Capabilities: Upload Malware

Gamaredon Group has registered domains to stage payloads.(Citation: Microsoft Actinium February 2022)(Citation: Unit 42 Gamaredon February 2022)
Enterprise T1218 .005 System Binary Proxy Execution: Mshta

Gamaredon Group has used `mshta.exe` to execute malicious HTA files.(Citation: Symantec Shuckworm January 2022)
.011 System Binary Proxy Execution: Rundll32

Gamaredon Group malware has used rundll32 to launch additional malicious components.(Citation: ESET Gamaredon June 2020)

Enterprise T1016 .001 System Network Configuration Discovery: Internet Connection Discovery

Gamaredon Group has tested connectivity between a compromised machine and a C2 server using Ping with commands such as `CSIDL_SYSTEM\cmd.exe /c ping -n 1`.(Citation: Symantec Shuckworm January 2022)
Enterprise T1204 .002 User Execution: Malicious File

Gamaredon Group has attempted to get users to click on Office attachments with malicious macros embedded.(Citation: TrendMicro Gamaredon April 2020)(Citation: ESET Gamaredon June 2020)(Citation: Symantec Shuckworm January 2022)(Citation: CERT-EE Gamaredon January 2021)(Citation: Microsoft Actinium February 2022)(Citation: Unit 42 Gamaredon February 2022)(Citation: Secureworks IRON TILDEN Profile)

Software
ID Name References Techniques
S0686 QuietSieve (Citation: Microsoft Actinium February 2022) Hidden Window, Web Protocols, Ingress Tool Transfer, Internet Connection Discovery, File and Directory Discovery, Peripheral Device Discovery, Data from Local System, Network Share Discovery, Screen Capture
S0147 Pteranodon (Citation: Microsoft Actinium February 2022) (Citation: Palo Alto Gamaredon Feb 2017) (Citation: Pterodo) (Citation: Secureworks IRON TILDEN Profile) (Citation: Symantec Shuckworm January 2022) (Citation: Unit 42 Gamaredon February 2022) Screen Capture, Windows Command Shell, Native API, Ingress Tool Transfer, Registry Run Keys / Startup Folder, Web Protocols, File and Directory Discovery, Deobfuscate/Decode Files or Information, Dynamic API Resolution, Visual Basic, Rundll32, Exfiltration Over C2 Channel, File Deletion, Local Data Staging, Virtualization/Sandbox Evasion, Mshta, Scheduled Task
S0097 Ping (Citation: Symantec Shuckworm January 2022) (Citation: TechNet Ping) Remote System Discovery
S0685 PowerPunch (Citation: Microsoft Actinium February 2022) Obfuscated Files or Information, PowerShell, Ingress Tool Transfer, Environmental Keying

References

  1. Boutin, J. (2020, June 11). Gamaredon group grows its game. Retrieved June 16, 2020.
  2. Unit 42. (2022, February 3). Russia’s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine. Retrieved February 21, 2022.
  3. Microsoft Threat Intelligence Center. (2022, February 4). ACTINIUM targets Ukrainian organizations. Retrieved February 18, 2022.
  4. Kasza, A. and Reichel, D. (2017, February 27). The Gamaredon Group Toolset Evolution. Retrieved March 1, 2017.
  5. Kakara, H., Maruyama, E. (2020, April 17). Gamaredon APT Group Use Covid-19 Lure in Campaigns. Retrieved May 19, 2020.
  6. CERT-EE. (2021, January 27). Gamaredon Infection: From Dropper to Entry. Retrieved February 17, 2022.
  7. Secureworks CTU. (n.d.). IRON TILDEN. Retrieved February 24, 2022.
  8. Symantec. (2022, January 31). Shuckworm Continues Cyber-Espionage Attacks Against Ukraine. Retrieved February 17, 2022.
  9. Raggi, M. (2021, December 1). Injection is the New Black: Novel RTF Template Inject Technique Poised for Widespread Adoption Beyond APT Actors . Retrieved December 9, 2021.
  10. Toulas, B. (2018, November 4). Ukraine links members of Gamaredon hacker group to Russian FSB. Retrieved April 15, 2022.
Навигация

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.