Security News > 2022 > January > Russian 'Gamaredon' hackers use 8 new malware payloads in attacks
Researchers at Symantec's Threat Hunter team, a part of Broadcom Software, have analyzed eight malware samples used by Gamaredon against Ukrainian targets in recent attacks, which could provide essential information for defenders to protect against the ongoing wave attacks.
These files launched a VBS file that dropped "Pteranodon," a well-documented backdoor that Gamaredon has been developing and improving for almost seven years now.
While recent attacks are still conducted using phishing emails, these attacks now drop eight different payloads, as described below.
All eight files sampled by Symantec's analysts from recent Gamaredon attacks are 7-zip self-extracting binaries that minimize user-interaction requirements.
CSIDL PROFILE. The Symantec report also concludes that many of the dropped files have unknown parent process hashes which weren't analyzed, so parts of the Gamaredon operation remain unclear.
File hashes for the new malware payloads discovered by Symantec can be found in their report.
News URL
Related news
- Hackers Hide Malware in Images to Deploy VIP Keylogger and 0bj3ctivity Stealer (source)
- How Russian hackers went after NGOs’ WhatsApp accounts (source)
- IPany VPN breached in supply-chain attack to push custom malware (source)
- Hacker infects 18,000 "script kiddies" with fake malware builder (source)
- MintsLoader Delivers StealC Malware and BOINC in Targeted Cyber Attacks (source)
- EU sanctions Russian GRU hackers for cyberattacks against Estonia (source)
- E.U. Sanctions 3 Russian Nationals for Cyber Attacks Targeting Estonia’s Key Ministries (source)
- Google says hackers abuse Gemini AI to empower their attacks (source)
- North Korean Hackers Deploy FERRET Malware via Fake Job Interviews on macOS (source)
- Hackers exploit SimpleHelp RMM flaws to deploy Sliver malware (source)