Gamaredon Group

The Gamaredon group, a threat actor active since at least 2013, uses sophisticated techniques to execute malicious campaigns. Notably, they employ signed binaries (T1116) in their operations and utilize tools coded in C/C++, C#, batch file, and VBScript. Despite the relative simplicity of their tools, the group has demonstrated innovative capabilities, such as deploying an Outlook VBA module. Their strategy involves installing multiple scripts and executables on each system and regularly updating them, making it challenging for defenders to counteract their activities. The group's activities have evolved over time, with recent developments indicating an increased complexity in their operations. Check Point's analysis reveals that the Gamaredon group typically conducts large-scale campaigns, followed by intelligence-gathering activities. They've also developed a new tool called "LitterDrifter," which appears to be an evolution from a previously reported USB Powershell worm tied to the group. This tool aligns with the group's objectives, maintaining a persistent command and control (C2) channel across a wide range of targets. Despite their fast development pace, the Gamaredon group occasionally exhibits a lack of attention to detail, as evidenced by issues that were later fixed in subsequent versions of their modules. Silent Push's investigation into the group's rapid flux operation further underscores this point. Users of AutoFocus, a contextual threat intelligence service, can view malware associated with the group's attacks using the Gamaredon Group tag. In summary, the group's remote template retrieves a VBS script to execute, establishing a persistent C2 check-in and retrieving the next payload when the group is ready for the next phase.