Community Footprints of Gamaredon Group

Beneath analysis is reflecting our observations throughout month of March 2022. We additionally wish to thank Maria Jose Erquiaga for her contribution in introduction and help in the course of the strategy of writing.

Overview

Because the Russian-Ukrainian warfare continues over typical warfare, cybersecurity professionals witnessed their area turning into an actual frontier. Menace actors choosing sides [1], group members turning towards one another [2], some individuals handing out DDoS instruments [3], some individuals mixing in to show it into revenue [4], and plenty of different tales, proving that this new frontier is altering each day, and its direct affect just isn’t restricted to geographical boundaries.

Whereas assaults appear to be evolving each day, it’s difficult for one to remain updated with all that’s going round. Subsequently, we imagine that you will need to distinguish between data and actionable intelligence. In Cisco World Menace Alerts, we wish to share our observations associated to this battle throughout March of 2022 and uncover how we are able to flip them into actionable intelligence collectively.

Menace Actors within the Russian-Ukrainian Battle

For the reason that fast escalation of the battle in 2022, safety researchers and analysts have been gathering data concerning the adversarial teams, malware, methods, and varieties of assaults carried out [1, 5, 6]. Among the teams and malware associated to the battle are described in Desk 1:

Desk 1: Menace actors and their relations

Gamaredon

Gamaredon group, often known as Primitive Bear, Shuckworm and ACTINIUM, is a sophisticated persistent menace (APT) based mostly in Russia. Their actions may be traced again as early as 2013, previous to Russia’s annexation of the Crimean Peninsula. They’re identified to focus on state establishments of Ukraine and western authorities entities positioned in Ukraine. Ukrainian officers attribute them to Russian Federal Safety Service, often known as FSB [17].

Gamaredon typically leverages malicious workplace information, distributed by way of spear phishing as the primary stage of their assaults. They’re identified to make use of a PowerShell beacon referred to as PowerPunch to obtain and execute malware for ensuing levels of assaults. Pterodo and QuietSieve are fashionable malware households that they deploy for stealing data and varied actions on goal [18].

We had been in a position to gather community IoC’s associated to Gamaredon infrastructure. Throughout our preliminary evaluation, a lot of the indicators weren’t attributed on to any particular malware and so they had been relatively listed as a part of Gamaredon’s infrastructure. Subsequently, we wished to research their infrastructure to know their arsenal and deployment in better element.

Community Infrastructure

The primary a part of this analysis is targeted on WHOIS document evaluation. We noticed that Gamaredon domains had been dominantly registered by REG[.]RU. Creation dates are going again as early as February 2019 and have a altering sample for the registrant electronic mail. Till August 2020, we noticed that message-yandex.ru@mail[.]ru was the principle registrant electronic mail. Later, it shifted to macrobit@inbox[.]ru, blended with the occasional utilization of message-yandex.ru@mail[.]ru and tank-bank15@yandex[.]ru. Area creation dates in among the WHOIS data are as latest as March 2022.

Apart from WHOIS data, the domains we noticed that had been associated to Gamaredon campaigns had a distinguishing naming conference. Whereas dataset consisted of domains (with out TLDs) various between 4 to 16 characters, 70% p.c of them had been between 7 to 10 characters. Mixed with a restricted group of top-level domains (TLDs) used (see Desk 2), this leads us to a naming sample for additional attribution. Moreover, the utilization of TLDs on area creation appears to be rotating.

Desk 2: TLD distribution and time in use

Within the case of area resolutions, we aimed to research the distribution of autonomous system numbers (ASN) utilized by resolved IP addresses (see Desk 3). As soon as extra, the proprietor REG[.]RU is main the checklist, proudly owning a lot of the domains. TimeWeb was the second this time, with 28% of the domains we discovered to be associated to Gamaredon actions. Domains having ‘. on-line’ and ‘.ru’ TLDs are recurrently updating their IP resolutions, virtually each day.

Desk 3: Distribution of IP addresses per ASN and proprietor

Tooling

After understanding the infrastructure, let’s proceed with their arsenal. We checked out related file samples for the domains by way of Umbrella and Virustotal. A pattern of the outcomes may be seen under. Referring to a file sort, we are able to see that the Gamaredon group prefers malicious workplace paperwork with macros. Additionally, they’re identified to make use of Pterodo, which is a continuously evolving customized backdoor [8, 18].

Desk 4: Domains, information (hash and sort), and malware title related to the Gamaredon group

After reviewing the behaviors of the related malicious samples, it’s simpler to construct attribution between the malicious area and the corresponding pattern. IP addresses resolved by the area are later used to ascertain uncooked IP command and management (C2) communication with a distinguishing URL sample. The next instance reveals how 1c7804155248e2596ec9de97e5cddcddbafbb5c6d066d972bad051f81bbde5c4 resolves gorigan[.]ru and makes use of its IP tackle to construct a C2 URL (http|https<IP>/<random alphanumerical string>). Subsequently, DNS and outgoing internet visitors is essential for its detection.

Detecting Gamaredon Exercise with World Menace Alerts 

In Cisco World Menace Alerts, we’re monitoring the Gamaredon group underneath the Gamaredon Exercise menace object. The menace description is enriched with MITRE references (see Determine 3).

Determine 4 reveals a detection pattern of Gamaredon exercise. Observe that the contaminated system tried to speak with the domains alacritas[.]ru, goloser[.]ru, and libellus[.]ru, which gave the impression to be sinkholed to the OpenDNS IP tackle of 146.112.61.[.]107.

Conclusion

We’ve walked by way of the steps of manufacturing intelligence from data we’ve collected. We started our evaluation with an unattributed checklist of community IoC’s and had been in a position to establish distinctive patterns of their metadata. Then, we pivoted to endpoint IoC’s and attributed domains to malware households. Subsequent, we confirmed how we turned it right into a detection of the Gamaredon group displayed within the Cisco World Menace Alerts portal.

To your comfort, right here’s a abstract of the intelligence we developed on this weblog put up:

References

[1] Cyber Group Tracker: https://cyberknow.medium.com/update-10-2022-russia-ukraine-war-cyber-group-tracker-march-20-d667afd5afff

[2] Conti ransomware’s inside chats leaked after siding with Russia: https://www.bleepingcomputer.com/information/safety/conti-ransomwares-internal-chats-leaked-after-siding-with-russia/

[3] Hackers sound name to arms with digital weapon aimed toward Russian web sites: https://cybernews.com/information/hackers-sound-call-to-arms-with-digital-weapon-aimed-at-russian-websites/

[4] Menace advisory: Cybercriminals compromise customers with malware disguised as pro-Ukraine cyber instruments: https://weblog.talosintelligence.com/2022/03/threat-advisory-cybercriminals.html

[5] Ukraine-Cyber-Operations: https://github.com/curated-intel/Ukraine-Cyber-Operations

[6] What You Have to Know About Russian Cyber Escalation in Ukraine: https://socradar.io/what-you-need-to-know-about-russian-cyber-escalation-in-ukraine/

[7] Gamaredon: https://assault.mitre.org/teams/G0047/

[8] Pteranodon: https://assault.mitre.org/software program/S0147/

[9] Sandworm: https://assault.mitre.org/teams/G0034/

[10] Menace Advisory: Cyclops Blink: https://weblog.talosintelligence.com/2022/02/threat-advisory-cyclops-blink.html

[11] Wizard Spider: https://assault.mitre.org/teams/G0102/

[12] Cobalt Strike: https://assault.mitre.org/software program/S0154

[13] Emotet: https://assault.mitre.org/software program/S0367

[14] Conti: https://assault.mitre.org/software program/S0575

[15] Ryuk: https://assault.mitre.org/software program/S0446

[16] TrickBot: https://assault.mitre.org/software program/S0446

[17] Technical Report Gamaredon/Armageddon group: https://ssu.gov.ua/uploads/information/DKIB/Technicalpercent20reportpercent20Armagedon.pdf

[18] ACTINIUM targets Ukrainian organizations: https://www.microsoft.com/safety/weblog/2022/02/04/actinium-targets-ukrainian-organizations/

We’d love to listen to what you suppose. Ask a Query, Remark Beneath, and Keep Related with Cisco Safe on social!

Cisco Safe Social Channels

Instagram
Fb
Twitter
LinkedIn

Share: