GamaCopy

Executive Summary

GamaCopy is a moderately sophisticated, state‑aligned threat actor that emerged in 2023 but has been active since 2021. It leverages a blend of custom malware, open‑source tools, and social engineering—particularly spear‑phishing with malicious Office macros—to infiltrate a wide spectrum of sectors across the globe. The group focuses on espionage against governmental, defense, critical infrastructure, and commercial targets, often using C2 over port 443 and exfiltration via SMTP to evade detection.

Goals & Targeting

GamaCopy’s strategic objective is to acquire sensitive technical and political information from high‑value targets in state, defense, critical infrastructure, and commercial sectors worldwide. By using culturally resonant phishing narratives—often framed as legitimate military communication—it aims to bypass users’ scrutiny while building footholds that provide continuous intelligence feeds via Remote Desktop tools and covert exfiltration channels. The actor prioritizes geographical breadth, targeting countries across Europe, Asia, the Americas, and the Middle East, with a particular focus on Russia’s domestic infrastructure and allied partners. The organization exhibits opportunistic expansion, incorporating publicly available exploits (e.g., TrueConf CVEs) whenever they become available to increase infection rates while maintaining stealth through dynamic server‑side evasion logic. Its ultimate intent is to sustain persistent presence and gather actionable data for political or economic espionage activities tied to the host nation’s strategic goals.

Key Capabilities

• custom malware development
• PowerShell-based backdoor deployment
• HTTP C2 communication with SSH tunneling
• task scheduler persistence disguised as legitimate updater
• exploitation of known vulnerabilities (TrueConf BDU:2025‑10114/10116)
• phishing via malicious PDFs and video conference links
• Java-based malicious downloaders
• use of legitimate software (NetSupport) for malware delivery
• incorporation of Mirai IoT malware
• automated spear-phishing campaigns with malicious attachments
• installer built with Smart Install Maker that drops multiple archive files
• extraction and execution of payloads from password‑protected RAR archives
• remote desktop access via AnyDesk host executable
• disabling Windows Defender through dedicated utility
• exfiltration of data over SMTP
• hiding process windows to evade detection
• password extraction from email clients
• zero‑day exploitation of Microsoft MSHTML framework (CVE-2026-21509, CVE-2026-21513)
• steganography to conceal payloads within Excel files and PNG images
• establishing persistence via COM hijacking
• loading proxy DLL that reconstructs payloads from steganographic images
• abusing cloud storage services (Filen.io, MEGA.nz) for C2 communications and data exfiltration
• deploying destructive wiper command deleting user profile directory files
• leveraging spear-phishing with malicious VBA macros to deploy Rust backdoor binary
• detecting installed security software on victim machines
• creating Windows registry persistence keys via malicious PowerShell commands
• downloading second-stage payloads using HTTP_VIP downloader (GhostFetch) and Rust backdoor (CHAR)
• using malicious LNK shortcuts to execute PowerShell download scripts
• uploading collected data using legitimate Rclone executable
• employing hex‑encoded payload embedding within UserForm controls in VBA macros

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

GamaCopy’s operations have been documented intermittently since 2021, with a surge in activity during the Russia-Ukraine conflict. The actor deploys daily spear‑phishing campaigns that mix legitimate imagery, military‑themed content, and malicious attachments; once executed, the malware can create multiple persistence pillars (scheduled tasks, COM hijack) while remaining hidden from standard endpoint defenses. The group exhibits a rapid deployment cadence—often delivering payloads within hours of credential compromise—and uses geographically tailored server‑side evasion to limit detection outside target nations. Victims span a wide range of industries: government ministries, defense contractors, critical infrastructure utilities, educational institutions, telecom operators, and commercial enterprises in sectors such as finance, energy, aeronautics, healthcare, and manufacturing. While the actor leverages both open‑source tools (AnyDesk, NetSupport) and custom code, there is evidence of destructive intentions via wiper functionality aimed at user profile directories—suggestive of a broader sabotage capability. Exfiltration primarily occurs over SMTP, sometimes masked within legitimate cloud storage traffic. Overall, GamaCopy demonstrates an adaptive, multi‑vector approach with both stealth and impact strategies, making it a persistent threat to global cyber sovereignty.

IOC Patterns

• DLL or PowerShell script files used as delivery payloads
• Scheduled task entries named like legitimate update scripts in LiteManager directory
• Malicious PDF attachments sent via phishing emails
• Unsigned TrueConf client binaries replacing official ones
• Domain-based distribution infrastructure for malware
• Phishing email with malicious executable attachment
• Office document exploiting CVE‑2026‑21509
• Password‑protected RAR archive download from C2 address
• Server‑side evasion responding only to specific geographic region and User‑Agent header

Recommended Actions

• Monitor and block unusual PowerShell execution, especially from new tasks
• Inspect and secure scheduled tasks; block unknown or disguised updates
• Implement email filtering to detect and drop malicious PDFs and phishing links
• Verify digital signatures of software updates; block unsigned executables
• Patch systems against TrueConf vulnerabilities (BDU:2025-10114/10116)
• Deploy application whitelisting to restrict execution of unknown installers
• Patch the CVE‑2026‑21509 vulnerability on all affected systems immediately
• Monitor for and block AnyDesk remote host management utilities
• Enforce Windows Defender to remain enabled; detect any attempts to disable it
• Detect and block SMTP‑based data exfiltration traffic
• Identify anomalous process hiding or window removal behavior

Suggested Tags