Russian 'Gamaredon' Hackers Back at Targeting Ukraine Officials

guest · Dec 6, 2019

Russian 'Gamaredon' Hackers Back at Targeting Ukraine Officials
December 6, 2019
https://www.securityweek.com/russian-gamaredon-hackers-back-targeting-ukraine-officials

Active since at least mid-2013 and also known as Primitive Bear, the Gamaredon group was first analyzed in April 2015. Over the past years, it has been observed engaged in various attacks targeting individuals involved with the Ukrainian government.

Weaponized documents were used as the initial infection vector in this campaign, likely delivered via spear-phishing. Analysis of these documents revealed malicious activity starting in September and continuing until November 25, Anomali’s security researchers explain in a report (PDF).
The malicious campaign appears to be ongoing, with the intended targets and the Tactics, Techniques and Procedures (TTPs) falling well in line with previous activity associated with the Russian hacking group Gamaredon.

“Russian-sponsored cyber capabilities have been well-documented over numerous malicious campaigns found and attributed by the security community, and this activity […] indicates the risk posed to entities by APT threat groups. Governments around the globe utilize campaigns for strategic purposes, and in Russia’s case, sometimes to coincide with armed forces activity,” Anomali concludes.
Click to expand...

Anomali: Malicious Activity Aligning with Gamaredon TTPs Targets Ukraine
(PDF - 1.50 MB): https://www.anomali.com/files/white-papers/Anomali_Threat_Research-Gamaredon_TTPs_Target_Ukraine-WP.pdf

guest · Feb 6, 2020

Gamaredon APT Improves Toolset to Target Ukraine Government, Military
February 5, 2020
https://threatpost.com/gamaredon-apt-toolset-ukraine/152568/

The Gamaredon advanced persistent threat (APT) group has been supercharging its operations lately, improving its toolset and ramping up attacks on Ukrainian national security targets.

Vitali Kremez, head of SentinelLabs, said in research released on Wednesday that he has been tracking an uptick in Gamaredon cyberattacks on Ukrainian military and security institutions that started in December. He said that these include digital attacks on physical infrastructure and field hardware, including artillery – along with more expected cyber-espionage activity.

“Based on SentinelLabs visibility into some of the affected victims, APT Gamaredon affected a large disposition of victim across Ukrainian separatist line with more than five thousand unique Ukrainian entities affected for the past months,” Kremez wrote.
In addition, the group is also now using a system of Nginx forwarders to process traffic from compromised victim machines, oftentimes relying on dynamic DNS providers, according to the analysis.
[7quote]
Click to expand...

guest · Feb 7, 2020

Who Are the Gamaredon Group and What Do They Want?
February 6, 2020
https://www.sentinelone.com/blog/who-are-the-gamaredon-group-and-what-do-they-want/

In new research published yesterday by SentineLabs, head of research Vitali Kremez reveals how a Russian-backed APT threat actor known as the ‘Gamaredon group’ has intensified its clandestine cyber warfare activities against Ukrainian national security and infrastructure targets, [...]
Who Are the Gamaredon Group?
According to the report findings, the Gamaredon group functions as a proxy for Russian intelligence and pro-Russian groups with a remit to conduct attacks such as espionage and intelligence gathering on Ukrainian military forces. In the event that armed conflict were to break out again between the Ukraine and separatists, intel gathered by the Gamaredon group would help to give the pro-Russian forces a strategic edge.
Multi-function Pterodo Custom Malware
The Computer Emergency Response Team of Ukraine (CERT-UA) has been warning for some time that the Pterodo-type malware it had been seeing on endpoints belonging to Ukrainian state authorities was likely a preparatory stage for a cyber attack. T
Click to expand...

However, the research showed that this toolset has had extensive updating. Social engineering campaigns serve to implant malware through obfuscated Excel and Word macros. The malware allows macro execution while disabling Visual Basic for Applications (VBA) warnings. It also uses a fake Microsoft digital certificate belonging to Microsoft Time-Stamp Service to achieve trust on the local system.
Click to expand...

SentinelLabs: Pro-Russian CyberSpy Gamaredon Intensifies Ukrainian Security Targeting

The Fifth Domain: Pro-Russian CyberSpy APT Gamaredon Wages Silent War with Ukranian Military & Law Enforcement
Click to expand...

guest · Jun 11, 2020

Gamaredon hackers use Outlook macros to spread malware to contacts
June 11, 2020
https://www.bleepingcomputer.com/ne...outlook-macros-to-spread-malware-to-contacts/

New tools attributed to the Russia-linked Gamaredon hacker group include a module for Microsoft Outlook that creates custom emails with malicious documents and sends them to a victim's contacts.
Gamaredon has been in the cyber espionage game since at least 2013, targeting national security institutions in Ukraine for political and military gain. It became more active since December 2019.
Automated spear phishing
A new package used by Gamaredon (Primitive Bear) in recent malicious campaigns contains a Visual Basic for Applications (VBA) project (.OTM file) that targets Microsoft Outlook email client with malicious macro scripts.

Compromising an email account to spread malware to contacts is not a new method but malware analysts at cyber-security company ESET believe that the method used by Gamaredon has not been publicly documented before.
Click to expand...

ESET: Gamaredon group grows its game

Conclusion
Despite the simplicity of most of their tools, the Gamaredon group also is capable of deploying some novelty, such as their Outlook VBA module. However, as it is far from stealthy, in the long run it is no match for a capable organization. The variety of tools Gamaredon has at its disposal can be very effective at fingerprinting a machine and understanding what sensitive data is available, then spreading throughout the network. Could this just be a way to deploy a much stealthier payload?
Click to expand...

guest · Nov 4, 2021

Ukraine identifies five members of the Gamaredon hacking group
November 4, 2021
https://www.bleepingcomputer.com/ne...-five-members-of-the-gamaredon-hacking-group/

SSU and the Ukrainian secret service say they have identified five members of the Gamaredon hacking group, a Russian state-sponsored operation known for targeting Ukraine since 2014.

This Gamaredon hacking group, tracked as Armageddon by the SSU, is allegedly operated under the FSB (Russian Federal Security Service) and is believed to be responsible for over 5,000 attacks in Ukraine since the operation began.
Click to expand...

Over the last seven years, Ukraine says the actors targeted over 1,500 government, public and private entities in the country, aiming to collect intelligence, disrupt operations, and take control over critical infrastructure facilities.

The five men accused of taking part in these attacks were identified by SSU investigators who claim to have unequivocal evidence of their involvement, coming from communication interceptions.
The investigators underline that they managed to identify the hackers despite using their own custom malware, anonymization tools, and were generally very diligent in hiding their digital trace.
Click to expand...

Entire toolset and tactics exposed
The SSU has published a technical activity report on Gamaredon, where they lay down several key points around the group’s toolset and tactics.

The report says the group is known to use Outlook macros and the deployment of EvilGnome backdoor to compromise systems.
Other details include highly targeted vulnerabilities such as the WinRAR CVE-2018-20250 vulnerability, which existed for almost two decades, and CVE-2017-0199, a remote code execution flaw on MS Office.
Click to expand...

guest · Jan 20, 2023

Gamaredon Group Launches Cyberattacks Against Ukraine Using Telegram
By Ravie Lakshmanan - January 20, 2023

The Russian state-sponsored cyber espionage group known as Gamaredon has continued its digital onslaught against Ukraine, with recent attacks leveraging the popular messaging app Telegram to strike military and law enforcement sectors in the country.

"The Gamaredon group's network infrastructure relies on multi-stage Telegram accounts for victim profiling and confirmation of geographic location, and then finally leads the victim to the next stage server for the final payload," the BlackBerry Research and Intelligence Team said in a report shared with The Hacker News. "This kind of technique to infect target systems is new."
Gamaredon, also known by names such as Actinium, Armageddon, Iron Tilden, Primitive Bear, Shuckworm, Trident Ursa, and Winterflounder, is known for its assaults against Ukrainian entities since at least 2013.
Click to expand...

The latest findings from BlackBerry demonstrate an evolution in the group's tactics, wherein a hard-coded Telegram channel is used to fetch the IP address of the server hosting the malware. The IP addresses are periodically rotated to fly under the radar.

It's also worth pointing out that the heavily obfuscated VBA script is only delivered if the target's IP address is located in Ukraine.

"The threat group changes IP addresses dynamically, which makes it even harder to automate analysis through sandbox techniques once the sample has aged out," BlackBerry pointed out.
Click to expand...

BlackBerry: Gamaredon (Ab)uses Telegram to Target Ukrainian Organizations

January 19, 2023
The Gamaredon Group has been actively targeting the Ukrainian government lately, relying on the infrastructure of the popular messaging service Telegram to bypass traditional network traffic detection techniques without raising obvious flags. Back in November 2022, BlackBerry uncovered a new Gamaredon campaign that relied on a multi-stage Telegram scheme to first profile potential victims, and then deliver the final payload along with the malicious command-and-control (C2).

This report provides information about the recent network infrastructure from Crimea that the Gamaredon Group uses, as well as analysis of each step before the victims receive the final payload.
Click to expand...

guest · Jan 29, 2023

Latvia confirms phishing attack on Ministry of Defense, linking it to Russian hacking group
By Daryna Antoniuk @daryna_antoniuk - January 28, 2023

The Russian cyber-espionage group known as Gamaredon may have been behind a phishing attack on Latvia’s Ministry of Defense last week, the ministry told The Record on Friday.
Click to expand...

Hackers sent malicious emails to several employees of the ministry, pretending to be Ukrainian government officials. The attempted cyberattack was unsuccessful, the ministry added.
The sample of the malicious email was first shared on Twitter by French cybersecurity company Sekoia.io this week.

The company obtained it from VirusTotal, a Google-owned service that analyzes suspicious files, where one of the targeted users may have downloaded it to verify its sender, according to Sekoia threat intelligence researcher Felix Aime.
Click to expand...

Researchers attributed this phishing campaign to Gamaredon because the hackers used the same domain (admou[.]org) as previous cyberattacks, Aime said. Earlier in December, the cybersecurity company Unit 42 also linked this domain to Gamaredon.

A spokesperson for Latvia’s Ministry of Defense confirmed that the latest attack was “most likely” linked to Gamaredon, although the investigation is still ongoing.
Click to expand...

Log in or Sign up

Russian 'Gamaredon' Hackers Back at Targeting Ukraine Officials

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Russian 'Gamaredon' Hackers Back at Targeting Ukraine Officials

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches