{
  "family": "gamaredon",
  "sample_count": 2,
  "category": "trojan",
  "description": "Trojan:Win32/Gamaredon (also tracked as Actinium, Shuckworm, or Primitive Bear) represents the malware ecosystem of a highly active Advanced Persistent Threat (APT) group explicitly linked to the Russian Federal Security Service (FSB). Unlike many APTs that prioritize deep stealth, Gamaredon is characterized by its loud, massive, and rapid spearphishing campaigns. They primarily target Ukrainian government, military, and law enforcement entities, using custom, heavily obfuscated VBScript and PowerShell backdoors to maintain access and exfiltrate data (`T1059.005`).<br><br><b>Understanding Gamaredon (Russian State-Sponsored APT)</b><br>To an end-user, the infection begins with a highly convincing, politically or militarily themed lure document. For threat intelligence analysts, Gamaredon is a fascinating study in 'quantity over quality' espionage. While their tools are technically simple compared to other state actors, they update them constantly (polymorphism) to evade detection and rely on sheer volume to ensure some infections succeed.<br><br><b>Execution and Espionage Mechanics</b><br>Infections typically start with spearphishing emails containing malicious Word documents (macro-enabled) or ZIP files containing LNK shortcuts (`T1566.001`). Upon execution, these staging mechanisms drop heavily obfuscated VBScript (`T1059.005`) into the `%AppData%` or `%Temp%` directories. Persistence is almost always achieved via Scheduled Tasks (`T1053.005`) or Startup folder manipulation. The core VBScript backdoors (often referred to as 'Ptero' variants) are designed to map local networks, steal files (specifically targeting `.doc`, `.xls`, and `.pdf`), and rapidly spread to USB drives (`T1091`) to jump air-gapped networks. Gamaredon frequently uses dynamic DNS (DDNS) providers or hijacked domains for C2 infrastructure.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is severe state-sponsored espionage and data theft. Host-based IoCs include EDR alerts for `wscript.exe` or `cscript.exe` executing highly obfuscated VBScripts from user directories, the creation of suspicious scheduled tasks (often with randomized names), and macro execution from Office applications (`winword.exe` spawning `cmd.exe`). Network IoCs involve HTTP/HTTPS beacons containing base64 encoded system information sent to DDNS domains (e.g., `.ddns.net`, `.hopto.org`).",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1091",
    "T1566.001",
    "T1053.005",
    "T1059.005"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1059.005",
      "name": "Command and Scripting Interpreter: Visual Basic (Extensive use of VBScript for backdoors)",
      "tactic": "Execution"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment (Primary delivery mechanism via weaponized documents)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1091",
      "name": "Replication Through Removable Media (Spreading via USB drives to infect air-gapped systems)",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task (Primary persistence mechanism)",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Isolate the infected endpoint immediately and assume a state-sponsored actor has active, interactive control of the machine.",
    "Analyze the obfuscated VBScripts dropped by the malware to extract the specific C2 domains and block them at the perimeter.",
    "Conduct a sweep across the enterprise for similar Scheduled Tasks or VBScript executions to identify other compromised hosts.",
    "Mandate the use of 'Protected View' for Office documents originating from the internet and strongly consider disabling Office Macros entirely via GPO."
  ],
  "what_to_avoid": [
    "Do not underestimate the threat due to the simplicity of the VBScript; Gamaredon uses these simple scripts to download much more dangerous, targeted modules.",
    "Avoid relying on static file hashes for detection, as Gamaredon's infrastructure rapidly generates new, polymorphic script variants for every target."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}