Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

The Gamaredon Group Toolset Evolution

Summary: Unit 42 reports that the Gamaredon Group, active since at least 2013, has shifted from off-the-shelf tools to custom-developed malware, including a downloader first seen in June 2015 and a backdoor called Pteranodon first seen in February 2016. The group distributes its payloads through compromised domains, dynamic DNS providers, Russian and Ukrainian ccTLDs, and Russian hosting providers, and antimalware tools have a poor record of detecting them.

What's compelling: The group's batch-script-heavy, modular malware and abuse of legitimate tools like wget have defeated antimalware detection, and its decoy documents target Ukrainian military and national security personnel - a reminder that tooling built to evade signature detection can sit on a network long enough to copy documents from every drive letter and user folder.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related