Gamaredon Group

Data from Local System

Gamaredon Group has collected files from infected systems and uploaded them to a C2 server.(Citation: ESET Gamaredon June 2020)(Citation: ESET Gamaredon Sept2024)

Data from Removable Media

A Gamaredon Group file stealer has the capability to steal data from newly connected logical volumes on a system, including USB drives.(Citation: Palo Alto Gamaredon Feb 2017)(Citation: ESET Gamaredon June 2020)(Citation: ESET Gamaredon Sept2024)

Data from Network Shared Drive

Gamaredon Group malware has collected Microsoft Office documents from mapped network drives.(Citation: ESET Gamaredon June 2020)(Citation: ESET Gamaredon Sept2024)

Screen Capture

Gamaredon Group's malware can take screenshots of the compromised computer every minute.(Citation: ESET Gamaredon June 2020)(Citation: SymantecCarbonBlack_ShuckwormUSB_Apr2025)(Citation: ESET Gamaredon Sept2024)

Automated Collection

Gamaredon Group has deployed scripts on compromised systems that automatically scan for interesting documents.(Citation: ESET Gamaredon June 2020)

Data Obfuscation

Gamaredon Group has used obfuscated VBScripts with randomly generated variable names and concatenated strings.(Citation: unit42_gamaredon_dec2022)

Web Protocols

Gamaredon Group has used HTTP and HTTPS for C2 communications.(Citation: Palo Alto Gamaredon Feb 2017)(Citation: TrendMicro Gamaredon April 2020)(Citation: ESET Gamaredon June 2020)(Citation: Symantec Shuckworm January 2022)(Citation: CERT-EE Gamaredon January 2021)(Citation: Unit 42 Gamaredon February 2022)(Citation: unit42_gamaredon_dec2022)(Citation: ESET Gamaredon Sept2024)(Citation: VenereCiscoTalos_Gamaredon_Mar2025)

Proxy

Gamaredon Group has used the Cloudflare Tunnel client to proxy C2 traffic.(Citation: ESET Gamaredon Sept2024)

Multi-hop Proxy

Gamaredon Group has used Tor for C2 traffic.(Citation: SymantecCarbonBlack_ShuckwormUSB_Apr2025)

Non-Application Layer Protocol

Gamaredon Group has used SOCKS5 over port 9050 for C2 communication.(Citation: SymantecCarbonBlack_ShuckwormUSB_Apr2025)

Web Service

Gamaredon Group has used GitHub repositories for downloaders which will be obtained by the group's .NET executable on the compromised system.(Citation: ESET Gamaredon June 2020)

Bidirectional Communication

Gamaredon Group has used several ways to try to resolve the C2 server, including: public third-party websites, an adversary-operated Telegraph channel, the ngrok utility and the TXT record of a hardcoded C2 domain.(Citation: ESET Gamaredon Sept2024)(Citation: SymantecCarbonBlack_ShuckwormUSB_Apr2025)

One-Way Communication

Gamaredon Group has used Telegram Messenger content to discover the IP address for C2 communications.(Citation: unit42_gamaredon_dec2022)

Ingress Tool Transfer

Gamaredon Group has downloaded additional malware and tools onto a compromised host.(Citation: Palo Alto Gamaredon Feb 2017)(Citation: TrendMicro Gamaredon April 2020)(Citation: ESET Gamaredon June 2020)(Citation: Microsoft Actinium February 2022)(Citation: ESET Gamaredon Sept2024)(Citation: VenereCiscoTalos_Gamaredon_Mar2025) For example, Gamaredon Group uses a backdoor script to retrieve and decode additional payloads once in victim environments.(Citation: unit42_gamaredon_dec2022)

Dynamic Resolution

Gamaredon Group has incorporated dynamic DNS domains in its infrastructure.(Citation: Unit 42 Gamaredon February 2022)

Fast Flux DNS

Gamaredon Group has used fast flux DNS to mask their command and control channel behind rotating IP addresses.(Citation: unit42_gamaredon_dec2022)(Citation: ESET Gamaredon Sept2024)(Citation: SilentPush_GamaredonFastFlux_Sept2023) Additionally, Gamaredon Group has used a low-frequency variant of the single-flux method.(Citation: Huntio_GamaredonFlux_Apr2025)

Non-Standard Port

Gamaredon Group has used port 6856 for C2 communications.(Citation: VenereCiscoTalos_Gamaredon_Mar2025)

Modify Registry

Gamaredon Group has removed security settings for VBA macro execution by changing registry values <code>HKCU\Software\Microsoft\Office\&lt;version&gt;\&lt;product&gt;\Security\VBAWarnings</code> and <code>HKCU\Software\Microsoft\Office\&lt;version&gt;\&lt;product&gt;\Security\AccessVBOM</code>.(Citation: ESET Gamaredon June 2020)(Citation: CERT-EE Gamaredon January 2021)(Citation: ESET Gamaredon Sept2024) Gamaredon Group has also modified Registry keys to hide folders and system files and to add the C2 address under `HKEY_CURRENT_USER\Console\WindowsUpdate`. (Citation: SymantecCarbonBlack_ShuckwormUSB_Apr2025)

Disable or Modify Tools

Gamaredon Group has delivered macros which can tamper with Microsoft Office security settings.(Citation: ESET Gamaredon June 2020)(Citation: ESET Gamaredon Sept2024)

Query Registry

Gamaredon Group has queried ` HKEY_CURRENT_USER\\Console\\WindowsUpdates` to obtain the C2 addresses.(Citation: SymantecCarbonBlack_ShuckwormUSB_Apr2025) Gamaredon Group has queried ` HKEY_CURRENT_USER\\Console\\WindowsUpdates` to obtain the C2 addresses.(Citation: SymantecCarbonBlack_ShuckwormUSB_Apr2025)

Internet Connection Discovery

Gamaredon Group has tested connectivity between a compromised machine and a C2 server using Ping with commands such as `CSIDL_SYSTEM\cmd.exe /c ping -n 1`.(Citation: Symantec Shuckworm January 2022) Gamaredon Group has searched the ping records to obtain the C2 address and has used ping to search for the C2’s status.(Citation: SymantecCarbonBlack_ShuckwormUSB_Apr2025)

System Owner/User Discovery

A Gamaredon Group file stealer can gather the victim's username to send to a C2 server.(Citation: Palo Alto Gamaredon Feb 2017)

Process Discovery

Gamaredon Group has used tools to enumerate processes on target hosts including Process Explorer.(Citation: Symantec Shuckworm January 2022)(Citation: Unit 42 Gamaredon February 2022)(Citation: SymantecCarbonBlack_ShuckwormUSB_Apr2025)

System Information Discovery

A Gamaredon Group file stealer can gather the victim's computer name and drive serial numbers to send to a C2 server.(Citation: Palo Alto Gamaredon Feb 2017)(Citation: TrendMicro Gamaredon April 2020)(Citation: CERT-EE Gamaredon January 2021)(Citation: SymantecCarbonBlack_ShuckwormUSB_Apr2025)(Citation: ESET Gamaredon Sept2024)

File and Directory Discovery

Gamaredon Group macros can scan for Microsoft Word and Excel files to inject with additional malicious macros. Gamaredon Group has also used its backdoors to automatically list interesting files (such as Office documents) found on a system.(Citation: ESET Gamaredon June 2020)(Citation: Unit 42 Gamaredon February 2022)(Citation: ESET Gamaredon Sept2024) Gamaredon Group has also identified directory trees, folders and files on the compromised host.(Citation: SymantecCarbonBlack_ShuckwormUSB_Apr2025)

Peripheral Device Discovery

Gamaredon Group tools have contained an application to check performance of USB flash drives. Gamaredon Group has also used malware to scan for removable drives.(Citation: Palo Alto Gamaredon Feb 2017)(Citation: ESET Gamaredon June 2020)(Citation: ESET Gamaredon Sept2024)

Security Software Discovery

Gamaredon Group has used PowerShell scripts to identify security software on the victim machine.(Citation: SymantecCarbonBlack_ShuckwormUSB_Apr2025)

Windows Management Instrumentation

Gamaredon Group has used WMI to execute scripts used for discovery and for determining the C2 IP address.(Citation: CERT-EE Gamaredon January 2021)(Citation: unit42_gamaredon_dec2022)(Citation: SymantecCarbonBlack_ShuckwormUSB_Apr2025)(Citation: ESET Gamaredon Sept2024) Gamaredon Group has used the following WMI query to search for a ping record: `Select * From Win32_PingStatus where Address = 'mil.gov.ua'`.(Citation: SymantecCarbonBlack_ShuckwormUSB_Apr2025)

Scheduled Task

Gamaredon Group has created scheduled tasks to launch executables after a designated number of minutes have passed.(Citation: ESET Gamaredon June 2020)(Citation: CERT-EE Gamaredon January 2021)(Citation: Microsoft Actinium February 2022)(Citation: unit42_gamaredon_dec2022)

PowerShell

Gamaredon Group has used obfuscated PowerShell scripts for staging.(Citation: Microsoft Actinium February 2022)(Citation: ESET Gamaredon Sept2024) Additionally, (LinkById : G0047) has used PowerShell based tools later in its attack chain.(Citation: SymantecCarbonBlack_ShuckwormUSB_Apr2025) Additionally, Gamaredon Group has used the PowerShell cmdlet `Get-Command` to download and execute the next stage payload.(Citation: VenereCiscoTalos_Gamaredon_Mar2025)

Windows Command Shell

Gamaredon Group has used various batch scripts to establish C2 and download additional files. Gamaredon Group's backdoor malware has also been written to a batch file.(Citation: Palo Alto Gamaredon Feb 2017)(Citation: ESET Gamaredon June 2020)(Citation: CERT-EE Gamaredon January 2021)(Citation: Unit 42 Gamaredon February 2022)

Visual Basic

Gamaredon Group has embedded malicious macros in document templates, which executed VBScript. Gamaredon Group has also delivered Microsoft Outlook VBA projects with embedded macros.(Citation: TrendMicro Gamaredon April 2020)(Citation: ESET Gamaredon June 2020)(Citation: CERT-EE Gamaredon January 2021)(Citation: Microsoft Actinium February 2022)(Citation: Secureworks IRON TILDEN Profile)(Citation: ESET Gamaredon Sept2024) Additionally, Gamaredon Group has executed VBScript files using wscript.exe.(Citation: SymantecCarbonBlack_ShuckwormUSB_Apr2025)

Native API

Gamaredon Group malware has used <code>CreateProcess</code> to launch additional malicious components.(Citation: ESET Gamaredon June 2020)(Citation: ESET Gamaredon Sept2024)

Malicious Link

Gamaredon Group has attempted to get users to click on a link pointing to a malicious HTML file leading to follow-on malicious content.(Citation: unit42_gamaredon_dec2022)(Citation: ESET Gamaredon Sept2024)

Malicious File

Gamaredon Group has attempted to get users to click on Office attachments with malicious macros embedded.(Citation: TrendMicro Gamaredon April 2020)(Citation: ESET Gamaredon June 2020)(Citation: Symantec Shuckworm January 2022)(Citation: CERT-EE Gamaredon January 2021)(Citation: Microsoft Actinium February 2022)(Citation: Unit 42 Gamaredon February 2022)(Citation: Secureworks IRON TILDEN Profile)(Citation: unit42_gamaredon_dec2022) Gamaredon Group has also attempted to get users to click on thematically named files.(Citation: VenereCiscoTalos_Gamaredon_Mar2025)

Component Object Model

Gamaredon Group malware can insert malicious macros into documents using a <code>Microsoft.Office.Interop</code> object.(Citation: ESET Gamaredon June 2020)(Citation: ESET Gamaredon Sept2024)

Automated Exfiltration

Gamaredon Group has used modules that automatically upload gathered documents to the C2 server.(Citation: ESET Gamaredon June 2020)

Exfiltration Over C2 Channel

A Gamaredon Group file stealer can transfer collected files to a hardcoded C2 server.(Citation: Palo Alto Gamaredon Feb 2017)(Citation: ESET Gamaredon Sept2024)(Citation: SymantecCarbonBlack_ShuckwormUSB_Apr2025)

Internal Defacement

Gamaredon Group has left taunting images and messages on the victims' desktops as proof of system access.(Citation: CERT-EE Gamaredon January 2021)

Disk Content Wipe

Gamaredon Group has used tools to delete files and folders from victims' desktops and profiles.(Citation: CERT-EE Gamaredon January 2021)

Spearphishing Attachment

Gamaredon Group has delivered spearphishing emails with malicious attachments to targets.(Citation: TrendMicro Gamaredon April 2020)(Citation: ESET Gamaredon June 2020)(Citation: CERT-EE Gamaredon January 2021)(Citation: Microsoft Actinium February 2022)(Citation: Unit 42 Gamaredon February 2022)(Citation: Secureworks IRON TILDEN Profile)(Citation: unit42_gamaredon_dec2022)(Citation: ESET Gamaredon Sept2024)(Citation: SilentPush_GamaredonFastFlux_Sept2023) Additionally, Gamaredon Group has distributed malicious LNK files compressed in ZIP archives.(Citation: VenereCiscoTalos_Gamaredon_Mar2025)

VNC

Gamaredon Group has used VNC tools, including UltraVNC, to remotely interact with compromised hosts.(Citation: Symantec Shuckworm January 2022)(Citation: Microsoft Actinium February 2022)(Citation: Unit 42 Gamaredon February 2022)

Taint Shared Content

Gamaredon Group has injected malicious macros into all Word and Excel documents on mapped network drives.(Citation: ESET Gamaredon June 2020)

Replication Through Removable Media

Gamaredon Group has replicated to removable media by leveraging the User Assist Reg Key and creating LNKs on all network and removable drives available on the infected host.(Citation: SymantecCarbonBlack_ShuckwormUSB_Apr2025)

Internal Spearphishing

Gamaredon Group has used an Outlook VBA module on infected systems to send phishing emails with malicious attachments to other employees within the organization.(Citation: ESET Gamaredon June 2020)

Office Application Startup

Gamaredon Group has inserted malicious macros into existing documents, providing persistence when they are reopened. Gamaredon Group has loaded the group's previously delivered VBA project by relaunching Microsoft Outlook with the <code>/altvba</code> option, once the Application.Startup event is received.(Citation: ESET Gamaredon June 2020)

Registry Run Keys / Startup Folder

Gamaredon Group tools have registered Run keys in the registry to give malicious VBS files persistence.(Citation: TrendMicro Gamaredon April 2020)(Citation: ESET Gamaredon June 2020)(Citation: CERT-EE Gamaredon January 2021)(Citation: unit42_gamaredon_dec2022)(Citation: ESET Gamaredon Sept2024)

Domains

Gamaredon Group has registered multiple domains to facilitate payload staging and C2.(Citation: Microsoft Actinium February 2022)(Citation: Unit 42 Gamaredon February 2022)(Citation: ESET Gamaredon Sept2024)(Citation: SymantecCarbonBlack_ShuckwormUSB_Apr2025)

Virtual Private Server

Gamaredon Group has used VPS hosting providers for infrastructure outside of Russia.(Citation: unit42_gamaredon_dec2022)(Citation: ESET Gamaredon Sept2024)(Citation: Huntio_GamaredonFlux_Apr2025)

Web Services

Gamaredon Group has used Cloudflare’s TryClouldflare service to obtain C2 nodes.(Citation: SymantecCarbonBlack_ShuckwormUSB_Apr2025)

Digital Certificates

Gamaredon Group has used the same TLS certificate across its infrastructure.(Citation: Huntio_GamaredonFlux_Apr2025)

Tool

Gamaredon Group has used various legitimate tools, such as `mshta.exe` and Reg, and services during operations.(Citation: unit42_gamaredon_dec2022)(Citation: ESET Gamaredon Sept2024)

Upload Malware

Gamaredon Group has registered domains to stage payloads.(Citation: Microsoft Actinium February 2022)(Citation: Unit 42 Gamaredon February 2022)

Obfuscated Files or Information

Gamaredon Group has delivered self-extracting 7z archive files within malicious document attachments.(Citation: ESET Gamaredon June 2020) Additionally, Gamaredon Group has used an obfuscated .drv file.(Citation: SymantecCarbonBlack_ShuckwormUSB_Apr2025)

Compile After Delivery

Gamaredon Group has compiled the source code for a downloader directly on the infected system using the built-in <code>Microsoft.CSharp.CSharpCodeProvider</code> class.(Citation: ESET Gamaredon June 2020)

Command Obfuscation

Gamaredon Group has used obfuscated or encrypted scripts.(Citation: ESET Gamaredon June 2020)(Citation: Microsoft Actinium February 2022)(Citation: SymantecCarbonBlack_ShuckwormUSB_Apr2025)(Citation: ESET Gamaredon Sept2024)

LNK Icon Smuggling

Gamaredon Group has used LNK files to hide malicious scripts for execution.(Citation: SymantecCarbonBlack_ShuckwormUSB_Apr2025)(Citation: VenereCiscoTalos_Gamaredon_Mar2025)

Compression

Gamaredon Group has delivered malicious payloads within compressed archives and zip files. (Citation: VenereCiscoTalos_Gamaredon_Mar2025)

Junk Code Insertion

Gamaredon Group has obfuscated .NET executables by inserting junk code.(Citation: ESET Gamaredon June 2020)

Match Legitimate Resource Name or Location

Gamaredon Group has used legitimate process names to hide malware including <code>svchosst</code>.(Citation: Unit 42 Gamaredon February 2022) Additionally, Gamaredon Group disguised malicious ZIP archives as Office documents that are related to the invasion.(Citation: VenereCiscoTalos_Gamaredon_Mar2025)

Process Injection

Gamaredon Group has injected Remcos into explorer.exe.(Citation: VenereCiscoTalos_Gamaredon_Mar2025)

File Deletion

Gamaredon Group tools can delete files used during an operation.(Citation: TrendMicro Gamaredon April 2020)(Citation: Symantec Shuckworm January 2022)(Citation: CERT-EE Gamaredon January 2021)(Citation: ESET Gamaredon Sept2024)

Deobfuscate/Decode Files or Information

Gamaredon Group tools decrypted additional payloads from the C2. Gamaredon Group has also decoded Base64-encoded source code of a downloader.(Citation: TrendMicro Gamaredon April 2020)(Citation: ESET Gamaredon June 2020)(Citation: ESET Gamaredon Sept2024) Additionally, Gamaredon Group has decoded Telegram content to reveal the IP address for C2 communications.(Citation: unit42_gamaredon_dec2022)

Mshta

Gamaredon Group has used `mshta.exe` to execute malicious files.(Citation: Symantec Shuckworm January 2022)(Citation: unit42_gamaredon_dec2022)(Citation: ESET Gamaredon Sept2024)(Citation: SymantecCarbonBlack_ShuckwormUSB_Apr2025)

Rundll32

Gamaredon Group malware has used rundll32 to launch additional malicious components.(Citation: ESET Gamaredon June 2020)

Template Injection

Gamaredon Group has used DOCX files to download malicious DOT document templates and has used RTF template injection to download malicious payloads.(Citation: Proofpoint RTF Injection) Gamaredon Group can also inject malicious macros or remote templates into documents already present on compromised systems.(Citation: TrendMicro Gamaredon April 2020)(Citation: ESET Gamaredon June 2020)(Citation: CERT-EE Gamaredon January 2021)(Citation: Microsoft Actinium February 2022)(Citation: Unit 42 Gamaredon February 2022)(Citation: Secureworks IRON TILDEN Profile)(Citation: ESET Gamaredon Sept2024)

Execution Guardrails

Gamaredon Group has used geoblocking to limit downloads of the malicious file to specific geographic locations.(Citation: unit42_gamaredon_dec2022)(Citation: VenereCiscoTalos_Gamaredon_Mar2025)

System Checks

Gamaredon Group has checked existing conditions, such as geographic location, device type, or system specification, before the victim is sent a malicious Word document.(Citation: SilentPush_GamaredonFastFlux_Sept2023)

Hidden Window

Gamaredon Group has used <code>hidcon</code> to run batch files in a hidden console window.(Citation: Unit 42 Gamaredon February 2022) Gamaredon Group has also executed PowerShell in a hidden window.(Citation: VenereCiscoTalos_Gamaredon_Mar2025)

Reflective Code Loading

Gamaredon Group has used an obfuscated PowerShell script that used `System.Reflection.Assembly` to gather and send victim information to the C2.(Citation: SymantecCarbonBlack_ShuckwormUSB_Apr2025)