Gamaredon

Overview

Trojan:Win32/Gamaredon (also tracked as Actinium, Shuckworm, or Primitive Bear) represents the malware ecosystem of a highly active Advanced Persistent Threat (APT) group explicitly linked to the Russian Federal Security Service (FSB). Unlike many APTs that prioritize deep stealth, Gamaredon is characterized by its loud, massive, and rapid spearphishing campaigns. They primarily target Ukrainian government, military, and law enforcement entities, using custom, heavily obfuscated VBScript and PowerShell backdoors to maintain access and exfiltrate data (`T1059.005`).

Understanding Gamaredon (Russian State-Sponsored APT)
To an end-user, the infection begins with a highly convincing, politically or militarily themed lure document. For threat intelligence analysts, Gamaredon is a fascinating study in 'quantity over quality' espionage. While their tools are technically simple compared to other state actors, they update them constantly (polymorphism) to evade detection and rely on sheer volume to ensure some infections succeed.

Execution and Espionage Mechanics
Infections typically start with spearphishing emails containing malicious Word documents (macro-enabled) or ZIP files containing LNK shortcuts (`T1566.001`). Upon execution, these staging mechanisms drop heavily obfuscated VBScript (`T1059.005`) into the `%AppData%` or `%Temp%` directories. Persistence is almost always achieved via Scheduled Tasks (`T1053.005`) or Startup folder manipulation. The core VBScript backdoors (often referred to as 'Ptero' variants) are designed to map local networks, steal files (specifically targeting `.doc`, `.xls`, and `.pdf`), and rapidly spread to USB drives (`T1091`) to jump air-gapped networks. Gamaredon frequently uses dynamic DNS (DDNS) providers or hijacked domains for C2 infrastructure.

Indicators of Compromise & Impact
The impact is severe state-sponsored espionage and data theft. Host-based IoCs include EDR alerts for `wscript.exe` or `cscript.exe` executing highly obfuscated VBScripts from user directories, the creation of suspicious scheduled tasks (often with randomized names), and macro execution from Office applications (`winword.exe` spawning `cmd.exe`). Network IoCs involve HTTP/HTTPS beacons containing base64 encoded system information sent to DDNS domains (e.g., `.ddns.net`, `.hopto.org`).

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1059.005: Restrict execution of scripting languages such as PowerShell, VBScript, or Python to authorized administrators. Enforce Script Block Logging.
• T1566.001: Scan email attachments for malicious macros, scripts, or suspicious archive files.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_GAMAREDON {
    meta:
        description = "Detects Gamaredon (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "gamaredon" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Gamaredon Activity
id: b97802e1eb7201592e5bcbe1c2a6a946
status: experimental
description: Detects generic indicators of the gamaredon malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*gamaredon*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate the infected endpoint immediately and assume a state-sponsored actor has active, interactive control of the machine.
2. Analyze the obfuscated VBScripts dropped by the malware to extract the specific C2 domains and block them at the perimeter.
3. Conduct a sweep across the enterprise for similar Scheduled Tasks or VBScript executions to identify other compromised hosts.
4. Mandate the use of 'Protected View' for Office documents originating from the internet and strongly consider disabling Office Macros entirely via GPO.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not underestimate the threat due to the simplicity of the VBScript; Gamaredon uses these simple scripts to download much more dangerous, targeted modules.
2. Avoid relying on static file hashes for detection, as Gamaredon's infrastructure rapidly generates new, polymorphic script variants for every target.

References & External Analysis

• Search "gamaredon" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Gobot
• Harvester
• Hideproc
• Bzub
• Bsvsebni

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/gamaredon.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.