Forest Global Training Partners

Cyber Risks · Cisco Talos

Gamaredon campaign abuses LNK files to distribute Remcos backdoor

Summary: Cisco Talos reports that the Gamaredon group is distributing LNK shortcut files inside ZIP archives, disguised as Office documents and named after Ukrainian and Russian individuals and troop-movement topics tied to the invasion of Ukraine. The LNK files carry PowerShell code that downloads and runs a next-stage payload, with a decoy document shown after infection, and Talos observed the Remcos backdoor loaded via DLL sideloading through TivoDiag.exe and mindclient.dll, injected into Explorer.exe and communicating with C2 server 146[.]185[.]233[.]96 on port 6856.

What's compelling: Talos found the payload servers returned HTTP 403 in its tests, consistent with Gamaredon restricting access to victims in Ukraine - so a 403 from these hosts is not evidence your organization is safe. The campaign's LNK files were built on just two machines previously seen by Talos in this group's incidents, and the payload servers sit in Germany and Russia across GTHost and HyperHosting infrastructure.

Read the original at Cisco Talos ↗

Topics
Malware
Related