393. Hunting for Recent Gamaredon Tactics, Techniques, and Procedures

Hello everyone!

Today we’ll take a look at several procedures observed in relatively recent Gamaredon (Disastrous Werewolf, Primitive Bear, Armageddon, Shuckworm, Aqua Blizzard) campaigns.

As before, the attackers used phishing emails for initial access. The emails contained archives exploiting the CVE-2025-8088 vulnerability in WinRAR. After successful exploitation, a malicious VBS file - for example, 1_13_4_1882_18.03.2026.vbs - was copied into %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\.

We can search for suspicious VBS file creation events in this folder:

event_type: "filecreatewin"

AND

file_path: ("programs\\startup" AND *.vbs)

Next, the VBS file downloads a malicious HTA file from Cloudflare Workers. For example, we can look for wscript.exe communications with the corresponding domains:

event_type: "dnsreqwin"

AND

dns_rname: "workers.dev"

AND

proc_file_path: "wscript.exe"

The HTA file is downloaded into the %TEMP% directory and executed via mshta.exe, giving us another opportunity for threat hunting:

event_type: "processcreatewin"

AND

proc_file_path: "mshta.exe"

AND

cmdline: "temp"

This file collects information about the compromised system, downloads the next stage, and executes it.

See you soon!

Comments

Post a Comment

Popular posts from this blog

343. Ransomware Gangs Abuse SystemSettingsAdminFlows to Evade Defenses

Image
Hello everyone! Today we'll look at another example of how adversaries abuse legitimate Windows executables to evade defenses. This time it's  SystemSettingsAdminFlows.exe . According to this report , DeadLock leveraged this utility to disable various features of Windows Defender: SystemSettingsAdminFlows.exe Defender RTP 1  SystemSettingsAdminFlows.exe Defender SpynetReporting 0  SystemSettingsAdminFlows.exe Defender SubmitSamplesConsent 0  SystemSettingsAdminFlows.exe Defender DisableEnhancedNotifications 1 The commands disable Real-Time Protection (RTP) and cloud-based protections, stops the machine from sending threat reports to Microsoft, and prevent Windows Defender from automatically submitting suspicious files for analysis. Worth a query, isn't it? event_type: "processcreatewin" AND proc_file_path: "systemsettingsadminflows.exe" AND cmdline: "defender" See you tomorrow!
Read more

082. Huniting for Malicious Browser Extensions

Image
Hello everyone! Malicious browser extensions are stopping to be an exotic threat. For example,  Rilide . It was first reported in April 2023, but became a common threat, and this report is another proof of it. Can we hunt for such extensions? Of course, yes! For example, usually threats like Rilide modify browser-reated LNK files to run it with " --load-extension " argument, like this: chrome.exe --load-extension="C:\Users\user\AppData\Local\Temp\MalExt" It means we can hunt for execution of common Chromium-based browsers with this argument: event_type: "processcreatewin" AND proc_file_name: ("chrome.exe" OR "brave.exe" OR "opera.exe" OR "msedge.exe")  AND cmdline: "load-extension" I'm sure you'll get false positives, but this is what we expect from threat hunting, right? Proper filtering will help you, I'm sure! See you tomorrow!
Read more

391. Hunting for TeamPCP's Stealer

Image
Hello everyone! What do I know about stealers? They seem to be very noisy! And today, we’ll once again see that in action using TeamPCP (Haze Wolf) as an example. This time , the stealer was implanted by attackers into three versions of the xinference package (2.6.0, 2.6.1, and 2.6.2). Essentially, it collects SSH keys, various credentials, environment variables, crypto wallets, and much more, then uses cURL for exfiltration. Let’s take a look at a couple of techniques the attackers used to obtain credentials. For example, they were interested in data stored in environment variables: env | grep AWS_ env | grep -i google env | grep -i gcloud env | grep -i azure This looks fairly suspicious from a detection perspective: event_type: processcreate* AND proc_file_path: "env" AND cmdline: ("grep" AND ("aws_" OR "google" OR "azure" OR "gcloud")) Another technique was abusing kubectl to obtain credentials: kubectl get secrets --all-n...
Read more