Gamaredon

Overview

Trojan:Win32/Gamaredon (also tracked as Actinium, Shuckworm, or Primitive Bear) represents the malware ecosystem of a highly active Advanced Persistent Threat (APT) group explicitly linked to the Russian Federal Security Service (FSB). Unlike many APTs that prioritize deep stealth, Gamaredon is characterized by its loud, massive, and rapid spearphishing campaigns. They primarily target Ukrainian government, military, and law enforcement entities, using custom, heavily obfuscated VBScript and PowerShell backdoors to maintain access and exfiltrate data (`T1059.005`).

Understanding Gamaredon (Russian State-Sponsored APT)
To an end-user, the infection begins with a highly convincing, politically or militarily themed lure document. For threat intelligence analysts, Gamaredon is a fascinating study in 'quantity over quality' espionage. While their tools are technically simple compared to other state actors, they update them constantly (polymorphism) to evade detection and rely on sheer volume to ensure some infections succeed.

Execution and Espionage Mechanics
Infections typically start with spearphishing emails containing malicious Word documents (macro-enabled) or ZIP files containing LNK shortcuts (`T1566.001`). Upon execution, these staging mechanisms drop heavily obfuscated VBScript (`T1059.005`) into the `%AppData%` or `%Temp%` directories. Persistence is almost always achieved via Scheduled Tasks (`T1053.005`) or Startup folder manipulation. The core VBScript backdoors (often referred to as 'Ptero' variants) are designed to map local networks, steal files (specifically targeting `.doc`, `.xls`, and `.pdf`), and rapidly spread to USB drives (`T1091`) to jump air-gapped networks. Gamaredon frequently uses dynamic DNS (DDNS) providers or hijacked domains for C2 infrastructure.

Indicators of Compromise & Impact
The impact is severe state-sponsored espionage and data theft. Host-based IoCs include EDR alerts for `wscript.exe` or `cscript.exe` executing highly obfuscated VBScripts from user directories, the creation of suspicious scheduled tasks (often with randomized names), and macro execution from Office applications (`winword.exe` spawning `cmd.exe`). Network IoCs involve HTTP/HTTPS beacons containing base64 encoded system information sent to DDNS domains (e.g., `.ddns.net`, `.hopto.org`).

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1059.005: Restrict execution of scripting languages such as PowerShell, VBScript, or Python to authorized administrators. Enforce Script Block Logging.
• T1566.001: Scan email attachments for malicious macros, scripts, or suspicious archive files.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_GAMAREDON_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gamaredon"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "gamaredon" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Gamaredon (Trojan) Execution & Triage
id: bc3c4593-fc1e-5d1c-b5b1-033e510e56ae
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Gamaredon malware family. Detects suspicious execution from temporary user
  directories with hidden window flags and background transfer utilities.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/gamaredon
- https://malware-families-catalog.systemhelpdesk.com/defensive/downloader-dropper-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.trojan
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1091
- attack.t1566_001
- attack.t1053_005
- attack.t1059_005
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \cscript.exe
    - \wscript.exe
    CommandLine|contains:
    - AppData\Local\Temp
    - -WindowStyle Hidden
    - /e:jscript
    - bitsadmin /transfer
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: medium

rule MALWARE_WIN_GAMAREDON_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gamaredon tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "gamaredon" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate the infected endpoint immediately and assume a state-sponsored actor has active, interactive control of the machine.
2. Analyze the obfuscated VBScripts dropped by the malware to extract the specific C2 domains and block them at the perimeter.
3. Conduct a sweep across the enterprise for similar Scheduled Tasks or VBScript executions to identify other compromised hosts.
4. Mandate the use of 'Protected View' for Office documents originating from the internet and strongly consider disabling Office Macros entirely via GPO.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not underestimate the threat due to the simplicity of the VBScript; Gamaredon uses these simple scripts to download much more dangerous, targeted modules.
2. Avoid relying on static file hashes for detection, as Gamaredon's infrastructure rapidly generates new, polymorphic script variants for every target.

References & External Analysis

• Search "gamaredon" on VirusTotal (External Analysis)
• Search "gamaredon" on Any.Run (Sandbox Sandbox)
• Search "gamaredon" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Trojan)

Explore other documented threats in the same operational category:

• Uk_Splitter
• Redator
• Siscos
• Hack_A_Tack
• Xxybyu
• Securityshield
• Lsslogger
• Wecod

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/gamaredon.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.