Gallmaker

Executive Summary

Gallmaker is a cyberespionage threat actor targeting Middle Eastern defense, military, and government sectors since at least December 2017. The group employs advanced persistent threat (APT) tactics, including spearphishing and malicious file deployments, to infiltrate victim networks and exfiltrate sensitive data.

Goals & Targeting

Gallmaker's strategic objectives appear focused on intelligence gathering from defense and military sectors in the Middle East. The group likely seeks sensitive information for political or strategic advantage, targeting countries where such data is critical. Their focus on government and military suggests a geopolitical agenda aligned with espionage goals.

Gallmaker is a cyberespionage group that has been active since December 2017, primarily targeting defense, military, and government sectors in the Middle East. The group's activities have included deploying malicious files and leveraging PowerShell for execution, as well as using-archive utilities to hide their operations. These tactics suggest a high level of technical proficiency, aligning with advanced persistent threat (APT) groups.

Key Capabilities

• Spearphishing campaigns
• Malicious file deployments
• PowerShell-based execution
• Obfuscation techniques
• Dynamic data exchange (DDE)
• Archive utilities for hiding malicious content

MITRE ATT&CK Tactics

Campaigns & Victims

Gallmaker's campaigns involve targeted attacks using spearphishing attachments and malicious Office documents. The group operates with moderate frequency, focusing on long-term access to exfiltrate data. While specific campaign details are limited, their TTPs align with those observed in APT groups targeting Middle Eastern governments.

IOC Patterns

• Spear-phishing emails with malicious附件
• Malicious file executions via PowerShell and VBA macros
• Archive files for payload delivery
• Exfiltration channels

Recommended Actions

• Monitor network traffic for known TTPs of APT groups.
• Implement strong email filtering to detect spearphishing attempts.
• Regularly update software to mitigate vulnerabilities exploited by APTs.
• Enhance user training on identifying suspicious emails and attachments.

Suggested Tags