G0047: Gamaredon Group

Gamaredon Group has left taunting images and messages on the victims' desktops as proof of system access.CitationCERT-EE Gamaredon January 2021

Gamaredon Group has used VPS hosting providers for infrastructure outside of Russia.Citationunit42_gamaredon_dec2022CitationESET Gamaredon Sept2024CitationHuntio_GamaredonFlux_Apr2025

Gamaredon Group has used obfuscated VBScripts with randomly generated variable names and concatenated strings.Citationunit42_gamaredon_dec2022

Gamaredon Group has used an Outlook VBA module on infected systems to send phishing emails with malicious attachments to other employees within the organization.[3]

Gamaredon Group has used WMI to execute scripts used for discovery and for determining the C2 IP address.CitationCERT-EE Gamaredon January 2021Citationunit42_gamaredon_dec2022CitationSymantecCarbonBlack_ShuckwormUSB_Apr2025CitationESET Gamaredon Sept2024 Gamaredon Group has used the following WMI query to search for a ping record: `Select * From Win32_PingStatus where Address = 'mil.gov.ua'`.CitationSymantecCarbonBlack_ShuckwormUSB_Apr2025

Gamaredon Group has used SOCKS5 over port 9050 for C2 communication.CitationSymantecCarbonBlack_ShuckwormUSB_Apr2025

Gamaredon Group macros can scan for Microsoft Word and Excel files to inject with additional malicious macros. Gamaredon Group has also used its backdoors to automatically list interesting files (such as Office documents) found on a system.[3][7]CitationESET Gamaredon Sept2024 Gamaredon Group has also identified directory trees, folders and files on the compromised host.CitationSymantecCarbonBlack_ShuckwormUSB_Apr2025

Gamaredon Group has replicated to removable media by leveraging the User Assist Reg Key and creating LNKs on all network and removable drives available on the infected host.CitationSymantecCarbonBlack_ShuckwormUSB_Apr2025

Gamaredon Group has deployed scripts on compromised systems that automatically scan for interesting documents.[3]

Gamaredon Group has used legitimate process names to hide malware including svchosst.[7] Additionally, Gamaredon Group disguised malicious ZIP archives as Office documents that are related to the invasion.CitationVenereCiscoTalos_Gamaredon_Mar2025

Gamaredon Group has compiled the source code for a downloader directly on the infected system using the built-in Microsoft.CSharp.CSharpCodeProvider class.[3]

Gamaredon Group has downloaded additional malware and tools onto a compromised host.[1][2][3][5]CitationESET Gamaredon Sept2024CitationVenereCiscoTalos_Gamaredon_Mar2025 For example, Gamaredon Group uses a backdoor script to retrieve and decode additional payloads once in victim environments.Citationunit42_gamaredon_dec2022

Gamaredon Group has used VNC tools, including UltraVNC, to remotely interact with compromised hosts.[4][5][7]

Gamaredon Group has obfuscated .NET executables by inserting junk code.[3]

Gamaredon Group malware has used rundll32 to launch additional malicious components.[3]

Gamaredon Group has delivered spearphishing emails with malicious attachments to targets.[2][3]CitationCERT-EE Gamaredon January 2021[5][7][8]Citationunit42_gamaredon_dec2022CitationESET Gamaredon Sept2024CitationSilentPush_GamaredonFastFlux_Sept2023 Additionally, Gamaredon Group has distributed malicious LNK files compressed in ZIP archives.CitationVenereCiscoTalos_Gamaredon_Mar2025

A Gamaredon Group file stealer can gather the victim's computer name and drive serial numbers to send to a C2 server.[1][2]CitationCERT-EE Gamaredon January 2021CitationSymantecCarbonBlack_ShuckwormUSB_Apr2025CitationESET Gamaredon Sept2024

Gamaredon Group has embedded malicious macros in document templates, which executed VBScript. Gamaredon Group has also delivered Microsoft Outlook VBA projects with embedded macros.[2][3]CitationCERT-EE Gamaredon January 2021[5][8]CitationESET Gamaredon Sept2024 Additionally, Gamaredon Group has executed VBScript files using wscript.exe.CitationSymantecCarbonBlack_ShuckwormUSB_Apr2025

Gamaredon Group's malware can take screenshots of the compromised computer every minute.[3]CitationSymantecCarbonBlack_ShuckwormUSB_Apr2025CitationESET Gamaredon Sept2024

Gamaredon Group has used PowerShell scripts to identify security software on the victim machine.CitationSymantecCarbonBlack_ShuckwormUSB_Apr2025

Gamaredon Group has collected files from infected systems and uploaded them to a C2 server.[3]CitationESET Gamaredon Sept2024

Gamaredon Group malware has collected Microsoft Office documents from mapped network drives.[3]CitationESET Gamaredon Sept2024

Gamaredon Group has registered domains to stage payloads.[5][7]

Gamaredon Group has delivered malicious payloads within compressed archives and zip files. CitationVenereCiscoTalos_Gamaredon_Mar2025

Gamaredon Group has used Telegram Messenger content to discover the IP address for C2 communications.Citationunit42_gamaredon_dec2022

Gamaredon Group has removed security settings for VBA macro execution by changing registry values HKCU\Software\Microsoft\Office\<version>\<product>\Security\VBAWarnings and HKCU\Software\Microsoft\Office\<version>\<product>\Security\AccessVBOM.[3]CitationCERT-EE Gamaredon January 2021CitationESET Gamaredon Sept2024 Gamaredon Group has also modified Registry keys to hide folders and system files and to add the C2 address under `HKEY_CURRENT_USER\Console\WindowsUpdate`. CitationSymantecCarbonBlack_ShuckwormUSB_Apr2025

Gamaredon Group has tested connectivity between a compromised machine and a C2 server using Ping with commands such as `CSIDL_SYSTEM\cmd.exe /c ping -n 1`.[4] Gamaredon Group has searched the ping records to obtain the C2 address and has used ping to search for the C2’s status.CitationSymantecCarbonBlack_ShuckwormUSB_Apr2025

Gamaredon Group has used an obfuscated PowerShell script that used `System.Reflection.Assembly` to gather and send victim information to the C2.CitationSymantecCarbonBlack_ShuckwormUSB_Apr2025

Gamaredon Group malware can insert malicious macros into documents using a Microsoft.Office.Interop object.[3]CitationESET Gamaredon Sept2024

Gamaredon Group has queried ` HKEY_CURRENT_USER\\Console\\WindowsUpdates` to obtain the C2 addresses.CitationSymantecCarbonBlack_ShuckwormUSB_Apr2025

A Gamaredon Group file stealer has the capability to steal data from newly connected logical volumes on a system, including USB drives.[1][3]CitationESET Gamaredon Sept2024

Gamaredon Group has used DOCX files to download malicious DOT document templates and has used RTF template injection to download malicious payloads.CitationProofpoint RTF Injection Gamaredon Group can also inject malicious macros or remote templates into documents already present on compromised systems.[2][3]CitationCERT-EE Gamaredon January 2021[5][7][8]CitationESET Gamaredon Sept2024

Gamaredon Group has delivered macros which can tamper with Microsoft Office security settings.[3]CitationESET Gamaredon Sept2024

Gamaredon Group tools decrypted additional payloads from the C2. Gamaredon Group has also decoded Base64-encoded source code of a downloader.[2][3]CitationESET Gamaredon Sept2024 Additionally, Gamaredon Group has decoded Telegram content to reveal the IP address for C2 communications.Citationunit42_gamaredon_dec2022

Gamaredon Group has attempted to get users to click on a link pointing to a malicious HTML file leading to follow-on malicious content.Citationunit42_gamaredon_dec2022CitationESET Gamaredon Sept2024

Gamaredon Group has injected malicious macros into all Word and Excel documents on mapped network drives.[3]

Gamaredon Group malware has used CreateProcess to launch additional malicious components.[3]CitationESET Gamaredon Sept2024

Gamaredon Group has used Cloudflare’s TryClouldflare service to obtain C2 nodes.CitationSymantecCarbonBlack_ShuckwormUSB_Apr2025

Gamaredon Group has used tools to delete files and folders from victims' desktops and profiles.CitationCERT-EE Gamaredon January 2021

A Gamaredon Group file stealer can gather the victim's username to send to a C2 server.[1]

Gamaredon Group has used the same TLS certificate across its infrastructure.CitationHuntio_GamaredonFlux_Apr2025

Gamaredon Group has used hidcon to run batch files in a hidden console window.[7] Gamaredon Group has also executed PowerShell in a hidden window.CitationVenereCiscoTalos_Gamaredon_Mar2025

Gamaredon Group has used LNK files to hide malicious scripts for execution.CitationSymantecCarbonBlack_ShuckwormUSB_Apr2025CitationVenereCiscoTalos_Gamaredon_Mar2025

Gamaredon Group tools can delete files used during an operation.[2][4]CitationCERT-EE Gamaredon January 2021CitationESET Gamaredon Sept2024

Gamaredon Group has used obfuscated PowerShell scripts for staging.[5]CitationESET Gamaredon Sept2024 Additionally, (LinkById : G0047) has used PowerShell based tools later in its attack chain.CitationSymantecCarbonBlack_ShuckwormUSB_Apr2025 Additionally, Gamaredon Group has used the PowerShell cmdlet `Get-Command` to download and execute the next stage payload.CitationVenereCiscoTalos_Gamaredon_Mar2025

Gamaredon Group has used port 6856 for C2 communications.CitationVenereCiscoTalos_Gamaredon_Mar2025

Gamaredon Group has used various legitimate tools, such as `mshta.exe` and Reg, and services during operations.Citationunit42_gamaredon_dec2022CitationESET Gamaredon Sept2024

Gamaredon Group has used modules that automatically upload gathered documents to the C2 server.[3]

Gamaredon Group has used HTTP and HTTPS for C2 communications.[1][2][3][4]CitationCERT-EE Gamaredon January 2021[7]Citationunit42_gamaredon_dec2022CitationESET Gamaredon Sept2024CitationVenereCiscoTalos_Gamaredon_Mar2025

Gamaredon Group has registered multiple domains to facilitate payload staging and C2.[5][7]CitationESET Gamaredon Sept2024CitationSymantecCarbonBlack_ShuckwormUSB_Apr2025

Gamaredon Group has used fast flux DNS to mask their command and control channel behind rotating IP addresses.Citationunit42_gamaredon_dec2022CitationESET Gamaredon Sept2024CitationSilentPush_GamaredonFastFlux_Sept2023 Additionally, Gamaredon Group has used a low-frequency variant of the single-flux method.CitationHuntio_GamaredonFlux_Apr2025

Gamaredon Group has injected Remcos into explorer.exe.CitationVenereCiscoTalos_Gamaredon_Mar2025

Gamaredon Group tools have contained an application to check performance of USB flash drives. Gamaredon Group has also used malware to scan for removable drives.[1][3]CitationESET Gamaredon Sept2024

A Gamaredon Group file stealer can transfer collected files to a hardcoded C2 server.[1]CitationESET Gamaredon Sept2024CitationSymantecCarbonBlack_ShuckwormUSB_Apr2025

Gamaredon Group has used Tor for C2 traffic.CitationSymantecCarbonBlack_ShuckwormUSB_Apr2025

Gamaredon Group has created scheduled tasks to launch executables after a designated number of minutes have passed.[3]CitationCERT-EE Gamaredon January 2021[5]Citationunit42_gamaredon_dec2022

Gamaredon Group has delivered self-extracting 7z archive files within malicious document attachments.[3] Additionally, Gamaredon Group has used an obfuscated .drv file.CitationSymantecCarbonBlack_ShuckwormUSB_Apr2025

Gamaredon Group has used tools to enumerate processes on target hosts including Process Explorer.[4][7]CitationSymantecCarbonBlack_ShuckwormUSB_Apr2025

Gamaredon Group has used obfuscated or encrypted scripts.[3][5]CitationSymantecCarbonBlack_ShuckwormUSB_Apr2025CitationESET Gamaredon Sept2024

Gamaredon Group has attempted to get users to click on Office attachments with malicious macros embedded.[2][3][4]CitationCERT-EE Gamaredon January 2021[5][7][8]Citationunit42_gamaredon_dec2022 Gamaredon Group has also attempted to get users to click on thematically named files.CitationVenereCiscoTalos_Gamaredon_Mar2025

Gamaredon Group has incorporated dynamic DNS domains in its infrastructure.[7]

Gamaredon Group has used the Cloudflare Tunnel client to proxy C2 traffic.CitationESET Gamaredon Sept2024

Gamaredon Group tools have registered Run keys in the registry to give malicious VBS files persistence.[2][3]CitationCERT-EE Gamaredon January 2021Citationunit42_gamaredon_dec2022CitationESET Gamaredon Sept2024

Gamaredon Group has used geoblocking to limit downloads of the malicious file to specific geographic locations.Citationunit42_gamaredon_dec2022CitationVenereCiscoTalos_Gamaredon_Mar2025

Gamaredon Group has used several ways to try to resolve the C2 server, including: public third-party websites, an adversary-operated Telegraph channel, the ngrok utility and the TXT record of a hardcoded C2 domain.CitationESET Gamaredon Sept2024CitationSymantecCarbonBlack_ShuckwormUSB_Apr2025

Gamaredon Group has used various batch scripts to establish C2 and download additional files. Gamaredon Group's backdoor malware has also been written to a batch file.[1][3]CitationCERT-EE Gamaredon January 2021[7]

Gamaredon Group has used `mshta.exe` to execute malicious files.[4]Citationunit42_gamaredon_dec2022CitationESET Gamaredon Sept2024CitationSymantecCarbonBlack_ShuckwormUSB_Apr2025

Gamaredon Group has inserted malicious macros into existing documents, providing persistence when they are reopened. Gamaredon Group has loaded the group's previously delivered VBA project by relaunching Microsoft Outlook with the /altvba option, once the Application.Startup event is received.[3]

Gamaredon Group has used GitHub repositories for downloaders which will be obtained by the group's .NET executable on the compromised system.[3]

Gamaredon Group has checked existing conditions, such as geographic location, device type, or system specification, before the victim is sent a malicious Word document.CitationSilentPush_GamaredonFastFlux_Sept2023