Sekoia.io’s investigation details how Gamaredon, an FSB-linked intrusion set targeting Ukraine, uses a multi-stage GammaLoad chain to maintain stealthy, persistent access through loaders, droppers, and registry-cached C2 configuration. The report shows the group abusing trusted services like Telegram, Telegraph, Cloudflare, and Check-Host to retrieve payloads and ultimately deliver GammaSteel. #Gamaredon #GammaLoad #GammaSteel #Sekoiaio #Telegram #Cloudflare #CheckHost
Keypoints
- Gamaredon, also tracked as UAC-0010 and Armagedon, is described as an FSB-operated Russian cyberespionage group focused on Ukrainian government, military, and critical infrastructure targets.
- The report introduces a unified naming taxonomy for Gamaredon’s tooling, grouping malware by function: GammaPhish, GammaLoad, GammaWorm, GammaSteel, and GammaWipe.
- GammaLoad is a multi-stage VBScript-based chain built to maintain continuous access and deliver the final payload GammaSteel.
- The infection chain hides activity in legitimate Windows features, uses registry caching in HKCUConsole, and relies on Dead Drop Resolvers hosted on trusted third-party services.
- The first stage fingerprints the host, searches for active C2 infrastructure, and uses cached registry values before falling back to DDR services such as Telegram, Telegraph, and Check-Host.
- The second stage writes payloads into an Alternate Data Stream in %TEMP%, establishes persistence with a scheduled task, and launches another loader from the ADS every 11 minutes.
- The third stage launches hidden PowerShell, disables SSL certificate validation, downloads a final implant, and executes it in memory after Base64 decoding and XOR decryption.
MITRE Techniques
- [T1082 ] System Information Discovery – The first-stage loader fingerprints the victim by collecting the computer name and disk serial number (‘retrieving the %COMPUTERNAME% and the hexadecimal serial number of the system drive’).
- [T1012 ] Query Registry – The malware checks multiple registry keys to locate cached C2 URLs and restore prior communications (‘it iterates through a specific sequence of registry keys to find an active URL’).
- [T1119 ] Automated Collection – The chain steals documents in transit, at rest, and while being edited in real time (‘steals documents whether they are stored, being transferred, or actively edited in real time’).
- [T1071.001 ] Web Protocols – C2 and payload retrieval are carried over HTTP GET traffic designed to blend in with normal web requests (‘the loader generates an HTTP GET request designed to blend with legitimate traffic’).
- [T1105 ] Ingress Tool Transfer – Payloads are fetched from remote C2/DDR infrastructure and executed on the host (‘fetches and executes the next stage’, ‘retrieval of another VBScript loader’).
- [T1218.005 ] System Binary Proxy Execution: Mshta – Not used in this article.
- [T1036 ] Masquerading – Randomized URL paths, extensions, and benign-looking User-Agent values are used to disguise malicious requests (‘dynamically generating random URL endpoints, filenames, and extensions’).
- [T1090.002 ] Proxy: External Proxy – The malware leverages third-party services as relays to resolve fresh C2 addresses (‘legitimate DDR services (Telegraph, Telegram, Check-Host)’).
- [T1053.005 ] Scheduled Task/Job: Scheduled Task – The second stage creates a scheduled task for repeated execution (‘registers a scheduled task named WindowsApplicationDataDsSvcCleanup’).
- [T1027 ] Obfuscated Files or Information – The scripts use Base64, ROT13, XOR, and delimiter-based obfuscation to conceal payloads (‘Base64 encoding’, ‘ROT13 obfuscation’, ‘XOR-decrypts’).
- [T1055 ] Process Injection – Not explicitly described in the article.
- [T1059.005 ] Command and Scripting Interpreter: Visual Basic – The loaders are VBScript-based and executed with WScript (‘VBScript code’, ‘wscript.exe “%TEMP%:divedz0f”‘).
- [T1059.001 ] Command and Scripting Interpreter: PowerShell – The third stage spawns hidden PowerShell to run an encoded command (‘spawns a hidden PowerShell process’).
- [T1140 ] Deobfuscate/Decode Files or Information – The malware Base64-decodes, XOR-decrypts, and ROT13-deobfuscates content before execution (‘Base64 decoded and then decrypted via XOR’).
- [T1112 ] Modify Registry – The loaders write C2 values into registry keys to persist configuration (‘updates HKCUConsoleHistoryURL with this new address’).
- [T1070.004 ] File Deletion – Not explicitly described in the article.
- [T1564.004 ] Hide Artifacts: NTFS File Attributes – The dropper stores payloads in an Alternate Data Stream (‘writes it to an Alternate Data Stream (ADS) within %TEMP%’).
- [T1102 ] Web Service – The campaign uses Telegram, Telegraph, Cloudflare Workers, and Check-Host as dead-drop and C2 infrastructure (‘trusted third-party platforms’, ‘hosting C2 servers’).
- [T1573 ] Encrypted Channel – The article notes XOR decryption of retrieved payloads (‘decrypted via XOR using a hardcoded key’).
Indicators of Compromise
- [File hashes] Sample payloads and loaders – bf94f4056627907d86ce1cae8b44c67a, a2c6e01001c62f6198e31a9d603977c6 and 2 more hashes
- [Domains / URLs] C2 and DDR infrastructure – hxxps://insight-sweet-drainage-appreciated.trycloudflare[.]com/log, hxxps://telegram[.]me/s/oberfarir
- [Domains / URLs] Additional hardcoded or observed infrastructure – hxxps://vids-road-christina-guards.trycloudflare[.]com, hxxps://[email protected][.]dev/vehis
- [IP addresses] C2 endpoints and registry-resolved infrastructure – 172.86.76[.]132, 172.86.72[.]243
- [File paths / ADS] Payload storage and execution – %TEMP%:divedz0f, wscript.exe “%TEMP%:divedz0f” [RANDOM ARGS] //b //e:vbscript
- [Registry keys] C2 configuration storage – HKCUConsoleHistoryURL, HKCUConsoleWindowsResponby, HKCUConsoleCloudURL, HKCUConsoleIpURL
- [Scheduled task] Persistence mechanism – WindowsApplicationDataDsSvcCleanup
- [User-Agent / string artifacts] Fingerprinting and request formatting – Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko, separator markers such as ## and ::
Read more: https://blog.sekoia.io/fsbs-matryoshka-2-3-gamaredons-gifts-that-keeps-unpacking-gammaload/