Rewterz Threat Advisory – Shuckworm APT Group aka Armageddon’s Phishing Campaign To Target Security Services Of Ukraine – Active IOCs

Severity

High

Analysis Summary

Shuckworm APT – aka Actinium, Armageddon, Primitive Bear, Gamaredon, and Trident Ursa – is a Russia-backed advanced persistent threat (APT) that has been operating since at least 2013. The main goal of this APT is to use the malicious document to gain control of the target machine. The exploit document uses the template injection technique to infect the victim’s computer with further malware. When the document is opened, it connects to the hacker’s server and downloads the payload file. Gamaredon’s tools are simple and designed to collect sensitive information from hacked systems and propagate it further. Its information-gathering efforts are nearly comparable to those of a second-tier APT, whose primary purpose is to collect and disseminate information with their units. The Gamaredon APT group’s current attack leverages a decree document from the Russian Federation government as bait. In July, this APT group targets Ukrainian entities with PowerShell info-stealer malware dubbed GammaLoad.

Recently, this APT group has conducted a phishing campaign against the Security Services of Ukraine (http://ssh.gov.ua) with the email subject Щодо зіпсуття військово-облікових документів СБУ (Regarding the corruption of SBU military accounting documents)

Impact

• Template Injection 
• Exposure of Sensitive Data

Indicators of Compromise

MD5

• 1ffb409a8d8e395d969193e93b66419e

SHA-256

• 9badf000ff2b5a387c91c5306e5fad218b553611f9c1b5c9470acbaa3812af91

SHA-1

• db43ec51e6028d7110f53314a680b2b013b0f5f6

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Maintain cyber hygiene by updating your anti-virus software and implementing a patch management lifecycle.
• Maintain Offline Backups – In a ransomware attack, the adversary will often delete or encrypt backups if they have access to them. That’s why it’s important to keep offline (preferably off-site), encrypted backups of data and test them regularly.
• Emails from unknown senders should always be treated with caution.
• Never trust or open ” links and attachments received from unknown sources/senders.