Threats Tagged 'fsb'

This analysis examines Gamaredon's (UAC-0010, Armagedon) advanced espionage operations targeting Ukrainian government, military, and critical infrastructure. The FSB-operated group deploys GammaSteel, a sophisticated stealer operating almost entirely from memory using Windows DPAPI encryption and storing 71 distinct payload functions in the HKCU\Printers registry key. The malware employs three concurrent data acquisition mechanisms: timed drive scans, USB monitoring for air-gapped systems, and real-time file surveillance. Exfiltration occurs via legitimate S3-compatible cloud storage (Tebi.io) with fallback to operator-controlled servers. The infection chain extensively uses VBScript for evasion, Dead Drop Resolvers on platforms like Telegram and Mastodon for C2 configuration, and includes bidirectional backdoor capabilities enabling arbitrary remote code execution. Infrastructure demonstrates high automation with servers rotated approximately every 24 hours.

MediumMalwareUkraine#vbscript#gammaworm#cyberespionage

Gamaredon, an FSB-operated cyberespionage group, continues targeting Ukrainian government, military, and critical infrastructure through sophisticated multi-stage infection chains. This analysis examines GammaLoad, a collection of VBScript loaders that establish continuous access through three distinct stages. The malware leverages Dead Drop Resolvers on legitimate platforms including Telegram, Telegraph, and Check-Host to maintain persistent C2 communications while storing configurations in Windows registry keys. Each stage employs different techniques: the first fingerprints hosts and uses failover mechanisms, the second writes payloads to Alternate Data Streams and establishes persistence via scheduled tasks, and the third executes obfuscated PowerShell to deliver the final GammaSteel payload. This matryoshka architecture enables operators to deploy arbitrary payloads while remaining largely invisible by abusing trusted Windows features and cloud platforms.

MediumMalwareUkraine#gammaload#gammasteel#gammawipe

ESET researchers uncovered collaboration between two notorious APT groups, Gamaredon and Turla, both associated with Russia's FSB. The groups were observed working together to compromise high-profile targets in Ukraine. Evidence shows Gamaredon tools being used to restart and deploy Turla's Kazuar backdoor on specific machines. This cooperation indicates a strategic alignment between different FSB units, with Gamaredon likely providing initial access for Turla's more sophisticated operations. The collaboration was detected through multiple attack chains involving various malware tools from both groups. This discovery highlights the evolving tactics of Russian cyber espionage efforts, particularly in the context of the ongoing conflict in Ukraine.

MediumMalwareUkrainePolandGermany+5#fsb#pterographin#ukraine