Security News > 2022 > January > Russian 'Gamaredon' hackers use 8 new malware payloads in attacks
Researchers at Symantec's Threat Hunter team, a part of Broadcom Software, have analyzed eight malware samples used by Gamaredon against Ukrainian targets in recent attacks, which could provide essential information for defenders to protect against the ongoing wave attacks.
These files launched a VBS file that dropped "Pteranodon," a well-documented backdoor that Gamaredon has been developing and improving for almost seven years now.
While recent attacks are still conducted using phishing emails, these attacks now drop eight different payloads, as described below.
All eight files sampled by Symantec's analysts from recent Gamaredon attacks are 7-zip self-extracting binaries that minimize user-interaction requirements.
CSIDL PROFILE. The Symantec report also concludes that many of the dropped files have unknown parent process hashes which weren't analyzed, so parts of the Gamaredon operation remain unclear.
File hashes for the new malware payloads discovered by Symantec can be found in their report.
News URL
Related news
- Russian hackers use RDP proxies to steal data in MiTM attacks (source)
- New IOCONTROL malware used in critical infrastructure attacks (source)
- 390,000 WordPress accounts stolen from hackers in supply chain attack (source)
- FBI spots HiatusRAT malware attacks targeting web cameras, DVRs (source)
- Hackers Exploit Webview2 to Deploy CoinLurker Malware and Evade Security Detection (source)
- Hackers Use Microsoft MSC Files to Deploy Obfuscated Backdoor in Pakistan Attacks (source)
- Rspack npm Packages Compromised with Crypto Mining Malware in Supply Chain Attack (source)
- North Korean Hackers Deploy OtterCookie Malware in Contagious Interview Campaign (source)
- Malware botnets exploit outdated D-Link routers in recent attacks (source)
- Chinese hackers targeted sanctions office in Treasury attack (source)