OldGremlin

Executive Summary

OldGremlin is a Russian-speaking ransomware group targeting organizations in Russia across multiple sectors, including banking and logistics. They employ phishing emails as an infection vector and use custom malware for both Windows and Linux systems, demanding large ransoms from victims.

Goals & Targeting

OldGremlin's targeting strategy appears to be driven by both financial gain and disruption of critical Russian sectors. By focusing on high-value targets within these sectors, the group aims to maximize the impact of its attacks and secure substantial ransom payments. The choice of victims reflects a strategic focus on industries where business interruption would have significant economic consequences.

OldGremlin, a financially motivated cyber threat group, has been operational for several years. Primarily targeting Russian organizations in sectors such as banking, logistics, industrial manufacturing, insurance, retail, and IT, the group is known to deploy custom ransomware. Their modus operandi involves phishing campaigns that deliver malware to compromise systems. Once inside, OldGremlin encrypts data and demands large ransoms, with some incidents reported to involve payments exceeding millions of dollars. The group's focus on Russian entities suggests a strategic approach aimed at disrupting local industries while maximizing financial gain through their ransomware activities.

Key Capabilities

• Custom ransomware deployment
• Phishing email campaigns
• Cross-platform malware targeting Windows and Linux systems
• Encrypted communication channels for command and control
• Large-scale ransom demands

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

OldGremlin has demonstrated a consistent campaign pattern over several years, focusing on Russian entities with high financial and operational value. Their campaigns often exhibit a slow-burn approach, allowing time to infect multiple targets before deploying ransomware. Despite their primary focus on Russia, the group may pose a potential threat to international organizations with Russian business ties or employees.

IOC Patterns

• Phishing emails targeting Russian-speaking individuals
• Presence of custom ransomware binaries in compromised systems
• Encrypted files indicating ransomware encryption patterns
• Network traffic anomalies consistent with command-and-control communications

Recommended Actions

• Implement robust email filtering to detect phishing attempts.
• Monitor IT infrastructure for signs of unauthorized access and data encryption.
• Deploy endpoint detection and response (EDR) solutions to identify malicious activity.
• Conduct regular user training on phishing awareness.
• Establish incident response plans tailored to ransomware attacks.
• Perform regular backups of critical systems to mitigate data loss.

Suggested Tags