Rewterz Threat Advisory – Multiple Microsoft Windows Defender Vulnerabilities
August 17, 2022Rewterz Threat Advisory – Multiple Apple macOS Vulnerabilities
August 17, 2022Rewterz Threat Advisory – Multiple Microsoft Windows Defender Vulnerabilities
August 17, 2022Rewterz Threat Advisory – Multiple Apple macOS Vulnerabilities
August 17, 2022Severity
High
Analysis Summary
Gamaredon, a Russian-linked APT group aka Armageddon, continues to target Ukrainian entities with GammaLoad, a PowerShell info-stealer malware. The ongoing cyber espionage campaign was confirmed by the Ukrainian Emergency Response Team.
Although the Gamaredon gang was initially identified by researchers in 2015, this Russia-backed advanced persistent threat (APT) has been operating since at least 2013. The group specifically targeted Ukrainian military and political institutions.
Gamaredon’s activity has continued uninterrupted throughout the sixth month of the conflict (Cyber warfare), with the most recent round of strikes lasting from July 15 to August 8, 2022.
The most latest infection vector consists of phishing emails that contain a self-extracting 7-Zip package that downloads an XML file from a “xsph.ru” subdomain. The PowerShell info-stealer that is executed as a result of the XML file has multiple significantly modified variations, most likely an attempt to avoid discovery.
“The downloading of the XML file onto victim networks was followed by the execution of a PowerShell stealer. We saw three versions of the same PowerShell stealer appear on the one system.It’s possible the attackers may have deployed multiple versions of the stealer, which were all very similar, as an attempt to evade detection.” according to analysis published recently.
The hosted files were on a subdomain that has been linked to Shuckworm activity since May 2022. GammaLoad.PS1 v2 is a PowerShell stealer malware that the attackers used as their final payload.
Additionally, the Gamaredon trademark tool, the Pterodo backdoor, as well as, in some cases, the Giddome backdoor, were downloaded by the Russian hackers using VBS downloaders. These backdoors provide the attackers the ability to capture screenshots from the desktop, log and steal keystrokes, download and run additional “.exe” and “.dll” payloads, and record audio via the host’s microphone.
In this recent campaign, threat actors were seen using legitimate remote desktop protocol utilities ‘Ammyy Admin’ and ‘AnyDesk’ to get remote access.
“Shuckworm’s long-term emphasis on Ukraine looks to be continuing unabated as the Russian invasion reaches the six-month mark. The fact that this latest effort continues even after CERT-UA reported it demonstrates that the group’s fear of exposure does not deter it from its activities. While Shuckworm is not the most operationally proficient espionage group, it compensates for this in its focus and persistence in relentlessly targeting Ukrainian organizations.” They conclude.
Image source:
Impact
- Template Injection
- Exposure of Sensitive Data
Indicators of Compromise
IP
- 45[.]63[.]94[.]49
- 165[.]22[.]215[.]30
- 149[.]28[.]99[.]187
- 45[.]63[.]79[.]134
- 140[.]82[.]58[.]157
- 139[.]180[.]172[.]67
- 141[.]164[.]45[.]236
- 95[.]179[.]167[.]182
MD5
- 5b27e1b4fc98cbcd497dba9e33d6ed0a
- d640767781188fa608b5fec293c2bc5b
SHA-256
- abb6aab63b29610dbc0a6d634b6777ff0a2a2b61c5f60bd09b0c3aa3919fa00d
- 30761d0a9b08c69cfdd135c69a537aef0df516b097cd9d6a0d9528bc907f4ddd
SHA-1
- 8244f815a9858a92d09ffd5c8e874d35c7f80001
- ce201e552998f24730bd105ddbebd41efcb3d08e
URL
- http[:]//159[.]223[.]235[.]224/crab/crevice[.]elg
- http[:]//a0698649[.]xsph[.]ru/preparations/band[.]xml
- http[:]//157[.]245[.]99[.]132/get[.]php
- http[:]//194[.]180[.]174[.]73/1[.]txt
Remediation
- Always be suspicious about emails sent by unknown senders.
- Never click on links/attachments sent by unknown senders.
- Block all threat indicators at your respective controls.
- Search for IOCs in your environment.