Dark Web Profile: Gamaredon APT

Gamaredon APT is a notorious Russian cyber espionage group active since 2013. Closely linked to Moscow’s Federal Security Service (FSB), it has primarily targeted Ukraine‘s government, military, and critical infrastructure sectors. The group has intensified its activities amid Ukraine’s counteroffensive, leveraging advanced tactics to infiltrate and disrupt operations.

Illustration created by BING AI

Who is Gamaredon APT

Gamaredon APT, also known as Primitive Bear, Actinium, or UAC-0010, is an Advanced Persistent Threat (APT) group with a history of cyberespionage campaigns dating back to 2013. Known by various aliases including Aqua Blizzard, Blue Otso, and Shuckworm, the group has primarily targeted Ukrainian governmental and military institutions, as well as NATO-aligned entities in certain campaigns

The group’s earliest activities are tied to the geopolitical unrest in 2014. During this time, Gamaredon targeted Ukrainian government officials, opposition party members, and journalists, shifting its focus to governmental institutions after the revolution. Its operations have consistently aligned with Russia’s strategic interests, underscoring its suspected affiliation with the Federal Security Service (FSB) in annexed Crimea.

Threat Actor Card of Gamaredon APT

In 2015, when researchers from LookingGlass reported on its early campaigns involving weaponized Microsoft Word documents. These documents contained metadata revealing a user named “Armagedon,” a misspelled version of “Armageddon,” which inspired the group’s name. In subsequent years, the group’s methods evolved, with CERT-UA issuing an advisory in 2018 on the use of their malware, Pterodo. This tool was integral to Gamaredon’s operations, designed for espionage and data exfiltration.

In the following years, Gamaredon adapted its tactics to exploit global events. For example, during the coronavirus pandemic in 2020, the group launched phishing campaigns using COVID-19-related themes to lure victims into opening malicious emails and attachments. These campaigns targeted not only Ukrainian entities but also victims in Europe and beyond.

Despite its relatively unsophisticated technical capabilities, Gamaredon compensates with relentless campaigns and a high degree of operational persistence and activities. Their activities frequently involve spear-phishing emails, weaponized USB drives, and malware-laden documents. This consistent targeting of Ukraine and alignment with Moscow’s geopolitical objectives make Gamaredon a significant cyber threat.

How and Whom They Attack

Gamaredon APT leverages a multi-pronged approach to compromise and infiltrate networks, targeting key sectors that align with Russia’s strategic interests.

Primary Targets

• Geopolitical Focus: Gamaredon predominantly targets Ukrainian governmental institutions, military organizations, and critical infrastructure. Their focus intensified during significant geopolitical events, such as Ukraine’s counteroffensive in 2023.
• NATO-Aligned Countries: According to ESET’s research, though primarily focused on Ukraine, Gamaredon has launched campaigns against NATO-aligned nations like Poland, Bulgaria, and Lithuania and Latvia

Methods of Attack

1. Spear-Phishing Campaigns:
   Gamaredon frequently uses phishing emails containing malicious attachments, including trojanized Word documents or HTA files. These files initiate a compromise when opened, often delivering malware like GammaLoad or Pterodo.

1. Weaponized USB Drives:
   They also employ USB drives equipped with malware like PteroLNK. These drives infect systems by enticing users to open files with compelling filenames, such as “mobilization” or “passwords,” propagating the infection laterally.
2. Legitimate Services Exploitation:
   Gamaredon leverages platforms like Cloudflare DNS, Telegram, and Telegraph for Command-and-Control (C2) communication and to obfuscate their activities.

How Do They Operate

Toolset and Malware Arsenal

Gamaredon APT employs a broad array of custom and evolving tools for various stages of the attack lifecycle, focusing on initial access, data exfiltration, and maintaining persistence:

• GammaLoad and GammaDrop: These tools are essential for downloading and deploying additional payloads. GammaLoad serves as a downloader that communicates with command-and-control (C2) servers to fetch encrypted payloads, while GammaDrop functions as a secondary deployment mechanism.
• PteroLNK: Designed for infecting USB drives, this tool propagates malware by dropping malicious LNK files, which execute payloads when accessed. It is also instrumental in lateral movement across systems.
• Pterodo: A multipurpose espionage tool used for data exfiltration, capable of deploying additional modules for tailored attacks on specific systems.
• GammaSteel and PteroPSDoor: These tools focus on stealing credentials, exfiltrating sensitive information, and maintaining long-term persistence on compromised networks.

Additional tools include VBScript-based payloads for obfuscation, PowerShell-based malware for remote control, and innovative uses of legitimate services like Telegram and Cloudflare DNS for C2 communication.

Timeline of toolset used by Gamaredon (ESET)

Cyber Kill Chain Analysis

1. Reconnaissance:
   Gamaredon identifies targets in Ukrainian institutions and military organizations, leveraging geopolitical events to create compelling phishing lures. These include documents with themes tied to ongoing crises, such as the COVID-19 pandemic or military mobilizations.

• Gamaredon (ACTINIUM) used phishing emails to impersonate organizations like the WHO, leveraging domains like “who-int[.]info” to appear legitimate. These emails included web bugs to track when messages were opened.

COVID-19 related phishing mail (Microsoft)

• Their lure documents, often based on real reports, contained remote templates delivered via URLs or static IPs to load malicious payloads. Gamaredon deployed multi-stage payloads, using obfuscated VBScripts, PowerShell commands, and self-extracting archives to evade detection and maintain persistence through scheduled tasks.

2. Weaponization:
   The group creates weaponized documents using tools like PteroDoc, which embeds malicious macros or remote template references in Word files. LNK files embedded with scripts like GammaDrop or PteroSand are also frequently used. Weaponized USB drives equipped with PteroLNK automatically spread malware to connected systems.
3. Delivery:
   Phishing emails with malicious attachments or compromised USB drives serve as the primary delivery mechanisms. These methods ensure widespread distribution and increase the likelihood of victim interaction.
4. Exploitation:
   Once opened, malicious files execute scripts that deploy malware payloads like PteroDash or PteroDoc. These payloads exploit user execution vulnerabilities rather than software flaws, relying on social engineering.
5. Installation:
   Gamaredon’s tools establish persistence through various means:

• Registry Modifications: Pterodo and other tools modify registry keys for persistence.
• Scheduled Tasks: Malware like PteroDash creates scheduled tasks to re-establish access after system reboots.
• Weaponized Templates: PteroTemplate modifies default Word templates to automatically weaponize new documents.

6. Command and Control (C2):
   The group uses legitimate services like Cloudflare DNS, Telegram, and Telegraph to obfuscate their communications and retrieve commands or additional payloads. By leveraging these platforms, Gamaredon reduces the likelihood of detection.

Deobfuscated code of GammaLoad malware that establishes connection to cloudflare-dns.com (RNBO)

7. Actions on Objectives:
   The ultimate goal is to exfiltrate sensitive information, including military intelligence, government communications, and operational plans. Tools like GammaSteel are tailored to extract credentials, while Pterodo ensures a steady flow of stolen data back to their servers.

How to Defend Against Gamaredon APT and Similar Russian APT Threats?

To protect against threats like Gamaredon APT, organizations must adopt a multi-layered cybersecurity strategy.

1. Strengthen Email Security:
   • Deploy advanced email filtering solutions to detect spear-phishing emails.
   • Train employees to recognize phishing attempts, especially those leveraging geopolitical events.
2. Monitor External Devices:
   • Implement strict policies for the use of USB drives and external storage devices.
   • Use Endpoint Detection and Response (EDR) tools to monitor USB device activity.
3. Improve Endpoint Protection:
   • Regularly patch operating systems and software to mitigate vulnerabilities.
   • Deploy anti-malware solutions capable of detecting obfuscated scripts and malicious document payloads.
4. Enhance Network Security:
   • Monitor for abnormal DNS queries and traffic patterns, especially involving services like Telegram or Cloudflare DNS.
   • Use network segmentation to limit the impact of potential breaches.
5. Threat Intelligence Integration:
   • Leverage threat intelligence feeds to stay updated on Gamaredon’s TTPs and IoCs.
   • Share threat intelligence with trusted partners and industry groups.

How Can SOCRadar Help?

SOCRadar offers comprehensive tools to detect and respond to APT threats like Gamaredon:

• Extended Threat Intelligence:
  • Gain actionable insights into emerging threats and associated IoCs.
  • Access curated data on Gamaredon’s evolving TTPs.
• Dark Web Monitoring:
  • Detect and analyze stolen data or mentions of targeted organizations in underground forums.
  • Monitor for tools or techniques shared by threat actors like Gamaredon.
• Digital Risk Protection:
  • Identify spear-phishing campaigns targeting your organization.
  • Track malicious domains registered for phishing or C2 purposes.

SOCRadar’s Threat Actor Intelligence provides thousands of IoCs for Gamaredon

In Summary

Gamaredon APT represents a persistent and evolving threat, leveraging spear-phishing campaigns, weaponized documents, and obfuscated malware to target Ukrainian institutions and NATO allies. Defending against such groups requires a proactive approach, including robust email, endpoint, and network security measures.

With SOCRadar’s capabilities, organizations can stay one step ahead of APT threats, ensuring robust defenses and swift incident response.

What are Gamaredon’s TTPs?

Techniques table provided by MITRE;