{"id":12569,"date":"2025-03-31T11:29:13","date_gmt":"2025-03-31T11:29:13","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/gamaredon-deploys-remcos-rat-in-ukraine\/"},"modified":"2025-03-31T11:29:14","modified_gmt":"2025-03-31T11:29:14","slug":"gamaredon-deploys-remcos-rat-in-ukraine","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/gamaredon-deploys-remcos-rat-in-ukraine\/","title":{"rendered":"Gamaredon Deploys Remcos RAT in Ukraine"},"content":{"rendered":"\n<\/p>\n
\n

\ue802<\/i>Mar 31, 2025<\/span>\ue804<\/i>Ravie Lakshmanan<\/span><\/span>Threat Intelligence \/ Malware<\/span><\/p>\n<\/div>\n

\n
\n<\/p>\n

<\/a>\n<\/div>\n

Organizations in Ukraine have been targeted in a recent phishing campaign, with the goal of distributing a remote access trojan known as Remcos RAT.<\/p>\n

According to Cisco Talos researcher Guilherme Venere, the file names used in the campaign utilize Russian words related to troop movements in Ukraine as a lure. The PowerShell downloader contacts servers located in Russia and Germany to download a ZIP file containing the Remcos backdoor.<\/p>\n

The campaign has been attributed to a Russian hacking group known as Gamaredon, which has been tracked under various monikers, including Aqua Blizzard, Armageddon, and Trident Ursa.<\/p>\n

\n

\n
\n\"Cybersecurity\"
\n<\/a>
\n<\/center>\n<\/div>\n

Gamaredon, believed to be affiliated with Russia’s Federal Security Service (FSB), has been operating since at least 2013 and is known for targeting Ukrainian organizations for espionage and data theft.<\/p>\n

The latest campaign involves distributing Windows shortcut files compressed inside ZIP archives, disguised as Microsoft Office documents related to the ongoing Russo-Ukrainian war. These archives are believed to be sent via phishing emails.<\/p>\n

The connection to Gamaredon is based on the use of two machines that were previously utilized by the threat actor for similar purposes.<\/p>\n

The LNK files contain PowerShell code that downloads and executes the next-stage payload, as well as a decoy file to maintain the illusion.<\/p>\n

The second stage involves another ZIP archive containing a malicious DLL, which is executed via DLL side-loading. The DLL decrypts and runs the final Remcos payload from encrypted files within the archive.<\/p>\n

This disclosure comes as Silent Push revealed a phishing campaign using website lures to gather information from Russian individuals sympathetic to Ukraine. The activity is believed to be the work of either Russian Intelligence Services or a threat actor aligned with Russia.<\/p>\n

\n

\n
\n\"Cybersecurity\"
\n<\/a>
\n<\/center>\n<\/div>\n

The campaign consists of four major phishing clusters, impersonating the U.S. Central Intelligence Agency (CIA), the Russian Volunteer Corps, and other organizations.<\/p>\n

The phishing pages are hosted on a bulletproof hosting provider, Nybula LLC, with the threat actors relying on Google Forms and email responses to gather personal information from victims.<\/p>\n

Silent Push noted that all the observed campaigns have similar traits and a common objective: collecting personal information from site-visiting victims.<\/p>\n

<\/p>\n

Found this article interesting? Follow us on Twitter \uf099<\/i><\/a> and LinkedIn<\/a> to read more exclusive content we post.<\/div>\n<\/div>\n