Rewterz Threat Alert – Gamaredon APT – Active IOCs

Severity

High

Analysis Summary

Gamaredon, the Russia-backed advanced persistent threat (APT) threat actor that has been active since at least 2013 has reinforced its cyber warfare activities a new surge of Gamaredon APT attacks targeting users with template injection of malicious documents. The attacker main target is to get control of the target system using the malicious document. The exploit document employs the template injection technique to install additional malware on the victim’s machine. Upon opening the document, it connects back to the hacker’s server to download the payload file

Impact

• Template Injection 
• Exposure of Sensitive Data

Indicators of Compromise

Domain Name

• surname192[.]temp[.]swtest[.]ru

Filename

• Щодо заходження суден під державним прапором в порти АР Крим на 27[.]01[.]2022[.]docx
• Щодо заходження суден під іноземним прапором в порти АР Крим на 27[.]01[.]2022[.]docx

MD5

• 178b0739ac2668910277cbf13f6386e8
• fd4de6bb19fac13487ea72d938999fbd

SHA-256

• a82cb2076b7274179d5f7246f8db274eda47a89392875b3c700f2fa15d70ab2e
• 839170c51d75bd1dc77f17b957846ace0caa19a83de837277d7294a47e5023b3

SHA-1

• 374c9059fce14f0d61945ecb7d9a96d6ef0ea31b
• 833d60a91f1726411898ecb4af0352cf47d24712

URL

• http[:]//surname192[.]temp[.]swtest[.]ru/prapor/su/derg[.]gif

Remediation

• Block the threat indicators at their respective controls.
• Search for IOCs in your environment.