{"id":16137,"date":"2019-08-21T20:40:11","date_gmt":"2019-08-22T04:40:11","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2019\/08\/21\/news-9880\/"},"modified":"2019-08-21T20:40:11","modified_gmt":"2019-08-22T04:40:11","slug":"news-9880","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2019\/08\/21\/news-9880\/","title":{"rendered":"The Gamaredon Group: A TTP Profile Analysis"},"content":{"rendered":"
\n
\n

A FortiGuard Labs Threat Analysis<\/i><\/b><\/p>\n

FortiGuard Labs recently discovered a fresh malicious campaign being run by the Gamaredon Group possibly targeting Ukrainian law enforcement and government agencies. We decided to provide an analysis of the current campaign, particularly focusing on the tools and methods used by these malicious actors to try to understand their methodologies and what resources are needed to launch these types of attacks.<\/p>\n

The Gamaredon Group has been actively launching spear-phishing attacks against Ukrainian government and military departments from the mid-2013s. In one article<\/a> published in the Kharkiv Observer \u2013 an independent Ukranian online publication \u2013 an unnamed source stated that even the Ukrainian Presidential Administration has been attacked by malware developed by the Gamaredon Group. In addition, the anonymous cybersecurity experts referenced in the article connected the malicious Gamaredon Group actors with Russian state-sponsored hackers.<\/p>\n

The group is very active. In addition to the campaign we will analyze in this report, they are also implicated<\/a> in the spreading of a new Linux malware \u2013 Evil Gnome.<\/p>\n

The Gamaredon Group has been active for more than 6 years, and during that time, their Tactics, Techniques, and Procedures (TTPs) have mostly remained the same. They primarily target Ukrainian organizations and resources using spear-phishing attacks, and they use military or similar documents as bait. Once they have found a victim, they then deploy remote manipulation system binaries (RMS) via self-extracting archives and batch command files.<\/p>\n

Current Campaign Analysis<\/h2>\n

As an example, we decided to analyze one of their latest samples. The following archive caught our attention for exploiting a WinRAR unacev2 module vulnerability and for having interesting content. In this case, it looked like someone was using the military conflict in Ukraine to deliver some sort of malware. A quick search for those patterns gave us the source of the archive \u2013 the Gamaredon Group.\u00a0<\/p>\n<\/p><\/div>\n