{
  "family": "gamaredon",
  "sample_count": 2,
  "category": "trojan",
  "description": "Trojan:Win32/Gamaredon (also tracked as Actinium, Shuckworm, or Primitive Bear) represents the malware ecosystem of a highly active Advanced Persistent Threat (APT) group explicitly linked to the Russian Federal Security Service (FSB). Unlike many APTs that prioritize deep stealth, Gamaredon is characterized by its loud, massive, and rapid spearphishing campaigns. They primarily target Ukrainian government, military, and law enforcement entities, using custom, heavily obfuscated VBScript and PowerShell backdoors to maintain access and exfiltrate data (`T1059.005`).<br><br><b>Understanding Gamaredon (Russian State-Sponsored APT)</b><br>To an end-user, the infection begins with a highly convincing, politically or militarily themed lure document. For threat intelligence analysts, Gamaredon is a fascinating study in 'quantity over quality' espionage. While their tools are technically simple compared to other state actors, they update them constantly (polymorphism) to evade detection and rely on sheer volume to ensure some infections succeed.<br><br><b>Execution and Espionage Mechanics</b><br>Infections typically start with spearphishing emails containing malicious Word documents (macro-enabled) or ZIP files containing LNK shortcuts (`T1566.001`). Upon execution, these staging mechanisms drop heavily obfuscated VBScript (`T1059.005`) into the `%AppData%` or `%Temp%` directories. Persistence is almost always achieved via Scheduled Tasks (`T1053.005`) or Startup folder manipulation. The core VBScript backdoors (often referred to as 'Ptero' variants) are designed to map local networks, steal files (specifically targeting `.doc`, `.xls`, and `.pdf`), and rapidly spread to USB drives (`T1091`) to jump air-gapped networks. Gamaredon frequently uses dynamic DNS (DDNS) providers or hijacked domains for C2 infrastructure.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is severe state-sponsored espionage and data theft. Host-based IoCs include EDR alerts for `wscript.exe` or `cscript.exe` executing highly obfuscated VBScripts from user directories, the creation of suspicious scheduled tasks (often with randomized names), and macro execution from Office applications (`winword.exe` spawning `cmd.exe`). Network IoCs involve HTTP/HTTPS beacons containing base64 encoded system information sent to DDNS domains (e.g., `.ddns.net`, `.hopto.org`).",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Gamaredon and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Gamaredon is classified as a Trojan. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Gamaredon establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Gamaredon typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Gamaredon compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Gamaredon should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads and staging behaviors are commonly associated with Gamaredon?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Gamaredon frequently operates as a loader or dropper designed to establish a foothold before downloading and executing secondary high-impact malware payloads. Depending on the threat actor's objectives, these dropped modules can range from ransomware and banking injects to modular infostealers and remote management backdoors."
      }
    },
    {
      "@type": "Question",
      "name": "How can security operations teams effectively detect and hunt for Gamaredon across enterprise endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Defenders should hunt for Gamaredon by deploying behavioral endpoint detection and response (EDR) rules that monitor suspicious process spawning (such as cmd.exe or powershell.exe spawned from office documents or temporary directories), anomalous outbound network connections from non-browser binaries, and unauthorized modifications to Windows Run keys and scheduled task registries."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1091",
    "T1566.001",
    "T1053.005",
    "T1059.005"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1059.005",
      "name": "Command and Scripting Interpreter: Visual Basic (Extensive use of VBScript for backdoors)",
      "tactic": "Execution"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment (Primary delivery mechanism via weaponized documents)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1091",
      "name": "Replication Through Removable Media (Spreading via USB drives to infect air-gapped systems)",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task (Primary persistence mechanism)",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Isolate the infected endpoint immediately and assume a state-sponsored actor has active, interactive control of the machine.",
    "Analyze the obfuscated VBScripts dropped by the malware to extract the specific C2 domains and block them at the perimeter.",
    "Conduct a sweep across the enterprise for similar Scheduled Tasks or VBScript executions to identify other compromised hosts.",
    "Mandate the use of 'Protected View' for Office documents originating from the internet and strongly consider disabling Office Macros entirely via GPO."
  ],
  "what_to_avoid": [
    "Do not underestimate the threat due to the simplicity of the VBScript; Gamaredon uses these simple scripts to download much more dangerous, targeted modules.",
    "Avoid relying on static file hashes for detection, as Gamaredon's infrastructure rapidly generates new, polymorphic script variants for every target."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}