Security Affairs

FEBRUARY 17, 2020

Security experts from Yoroy-Cybaze ZLab have conducted a detailed analysis of an implant used by the Gamaredon APT group in a recent campaign. Gamaredon has been active since 2014, and during this time, the modus operandi has remained almost the same. Technical Analysis. Introduction. Cleaning the script we obtain: Figure 9.

Archiving 90

Archiving Military IT Phishing 90

Security Affairs

JUNE 4, 2019

During recent times, Gamaredon is targeting the Ukrainian military and law enforcement sectors too, as officially stated by the CERT-UA. Technical Analysis. The infection chain is composed by different stages of password protected SFX (self extracting archive), each containing vbs or batch scripts. Malicious e-mail.

Archiving 63

Archiving Passwords File names Military 63

Security Affairs

APRIL 12, 2019

Technical Analysis. Figure 2: password required to view and modify macros on document. The first peculiarity of the malicious document is the protected macro, in fact, when the user tries to read it immediately shows a message box asking for password. Further detail about AMSI have been described in a previous analysis report.

Passwords 92

Passwords Metadata Military Government 92