cyber.hendryadrian.com
Threat Research · hunt.io

Hunt.io Details Gamaredon DNS Patterns and ShadowPad-Linked Infrastructure

· Original article ↗

Summary

Hunt.io researchers describe Gamaredon’s short-TTL, rotating DNS infrastructure and a separate server cluster linked to a ShadowPad backdoor, detailing its delivery chain, shared certificate clues, and indicators of compromise.

Key points

  • Hunt.io identified more than 30 servers linked to Gamaredon between March 31 and April 7, 2025; many used .ru domains registered through REGRU-RU and were hosted by DigitalOcean or BL Networks.
  • Observed Gamaredon domains used five-second TTLs, wildcard A records, and shifting IP addresses while retaining static nameservers, consistent with a slower form of single-flux DNS.
  • A separate server cluster shared a suspicious TLS certificate and infrastructure traits overlapping with activity attributed to RedFoxtrot/Nomad Panda.
  • One server resolved to a ShadowPad command-and-control domain contacted by Dvx.zip, which contains the backdoor and a legitimate Windows executable used for DLL side-loading.
  • The delivery chain used a PowerShell script and batch file; the same script appeared across multiple delivery points, suggesting infrastructure rotation around a consistent delivery method.
  • The article publishes domains, IP addresses, filenames, and SHA-256 hashes as indicators for defenders.

Article Details

Attack Vectors
  • Gamaredon used phishing campaigns against government and civil-society targets, among others.
  • Gamaredon used short-TTL DNS records, changing IP resolutions, and wildcard A records to maintain flux-like infrastructure.
  • A ShadowPad sample was delivered in Dvx.zip, downloaded from 149.28.137[.]179 at /a/Dvx.zip using Packagec.ps1.
  • The ShadowPad delivery archive contained a batch script that launches a renamed legitimate executable vulnerable to DLL side-loading.
  • The article reports a ShadowPad command-and-control domain contacted by the archive's sample.
Defensive Notes
  • Use DNS anomaly detection, infrastructure clustering, and threat-intelligence correlation to identify rapidly changing resolutions, short TTLs, and wildcard records.
  • Track reused TLS certificates and JA4X fingerprints to identify related infrastructure.
  • Monitor the listed IPs, domains, and file hashes as threat-research indicators.
  • The article notes that Gamaredon’s observed flux-like changes were slower than botnet fast flux and may have been manually or automatically managed.

Indicators of compromise

TypeIndicatorContext
DOMAINantitrots[.]ruListed as a Gamaredon-associated domain.
DOMAINbaklchug[.]ruListed as a Gamaredon-associated domain.
DOMAINchinosadame[.]ruListed as a Gamaredon-associated domain.
DOMAINendless-bridge[.]ruListed as a Gamaredon-associated domain.
DOMAINhome1and[.]ruListed as a Gamaredon-associated domain.
DOMAINiafren[.]ruListed as a Gamaredon-associated domain.
DOMAINinnocentmillions[.]ruGamaredon-associated domain observed resolving to changing IPs and using wildcard A records.
DOMAINjedemdasseine[.]ruListed as a Gamaredon-associated domain.
DOMAINmeuviresse[.]ruListed as a Gamaredon-associated domain.
DOMAINprostali[.]ruListed as a Gamaredon-associated domain.
DOMAINrookida[.]ruListed as a Gamaredon-associated domain.
DOMAINrudanka[.]ruListed as a Gamaredon-associated domain.
DOMAINspanishsky[.]ruListed as a Gamaredon-associated domain.
DOMAINstatic[.]developers-cloudfare[.]usSpoofed Cloudflare-named domain resolving to the server reported hosting the Dvx.zip payload.
DOMAINstudomed[.]ruListed as a Gamaredon-associated domain.
DOMAINtoretsky[.]ruListed as a Gamaredon-associated domain.
DOMAINupdate[.]updatemic[.]comReported ShadowPad command-and-control domain contacted by the sample.
DOMAINvinnichich[.]ruListed as a Gamaredon-associated domain.
DOMAINwww[.]bakalchug[.]ruListed as a Gamaredon-associated domain.
DOMAINwww[.]langra[.]ruListed as a Gamaredon-associated domain.
DOMAINwww[.]neonation[.]ruListed as a Gamaredon-associated domain.
DOMAINwww[.]phlovel[.]ruListed as a Gamaredon-associated domain.
HOSTNAMEgssllxqxqzyo[.]giize[.]comListed as a hostname in the RedFoxtrot-linked server cluster.
HOSTNAMEopwmail[.]kozow[.]comListed as a hostname in the RedFoxtrot-linked server cluster.
HOSTNAMEzngb[.]kozow[.]comListed as a hostname in the RedFoxtrot-linked server cluster.
IPV4104[.]131[.]190[.]132Listed as a Gamaredon-associated network observable.
IPV4134[.]209[.]244[.]43Listed as a Gamaredon-associated network observable.
IPV4139[.]59[.]13[.]239Listed as a Gamaredon-associated network observable.
IPV4139[.]59[.]153[.]79Listed as a Gamaredon-associated network observable.
IPV4139[.]59[.]189[.]155Listed as a Gamaredon-associated network observable.
IPV4139[.]59[.]95[.]111Listed as a Gamaredon-associated network observable.
IPV4139[.]68[.]15[.]131Listed as a Gamaredon-associated network observable.
IPV4139[.]84[.]142[.]99Listed as a RedFoxtrot-linked network observable.
IPV4142[.]93[.]145[.]206Listed as a Gamaredon-associated network observable.
IPV4142[.]93[.]232[.]225Listed as a Gamaredon-associated network observable.
IPV4143[.]110[.]218[.]175Listed as a Gamaredon-associated network observable.
IPV4149[.]248[.]77[.]157Listed as a Gamaredon-associated network observable.
IPV4149[.]28[.]137[.]179Server reported hosting the Dvx.zip ShadowPad delivery archive.
IPV4157[.]230[.]152[.]7Listed as a Gamaredon-associated network observable.
IPV4159[.]203[.]17[.]42Listed as a Gamaredon-associated network observable.
IPV4159[.]203[.]2[.]177Listed as a Gamaredon-associated network observable.
IPV4159[.]65[.]192[.]30Listed as a Gamaredon-associated network observable.
IPV4159[.]65[.]205[.]28Listed as a Gamaredon-associated network observable.
IPV4162[.]33[.]179[.]216Listed as a Gamaredon-associated network observable.
IPV4165[.]227[.]39[.]7Listed as a Gamaredon-associated network observable.
IPV4167[.]99[.]90[.]162Listed as a Gamaredon-associated network observable.
IPV4168[.]100[.]11[.]116Listed as a Gamaredon-associated network observable.
IPV4168[.]100[.]11[.]43Listed as a Gamaredon-associated network observable.
IPV4168[.]100[.]9[.]156Observed as a later IP resolution for Gamaredon-associated infrastructure.
IPV4172[.]235[.]10[.]252RedFoxtrot-linked cluster IP associated with the listed giize[.]com hostname.
IPV4172[.]236[.]187[.]135RedFoxtrot-linked cluster IP associated with the listed kozow[.]com hostnames.
IPV4178[.]62[.]238[.]209Listed as a Gamaredon-associated network observable.
IPV4206[.]189[.]135[.]34Listed as a Gamaredon-associated network observable.
IPV4206[.]189[.]29[.]231Listed as a Gamaredon-associated network observable.
IPV4209[.]38[.]196[.]253Listed as a Gamaredon-associated network observable.
IPV4216[.]245[.]184[.]160Listed as a Gamaredon-associated network observable.
IPV445[.]55[.]235[.]87Listed as a Gamaredon-associated network observable.
IPV445[.]55[.]42[.]145Listed as a Gamaredon-associated network observable.
IPV445[.]61[.]139[.]116Listed as a Gamaredon-associated network observable.
IPV445[.]77[.]33[.]174RedFoxtrot-linked cluster server reported resolving to the ShadowPad C2 domain.
IPV446[.]101[.]240[.]172Listed as a Gamaredon-associated network observable.
IPV446[.]101[.]91[.]224Listed as a Gamaredon-associated network observable.
IPV464[.]227[.]185[.]216Listed as a RedFoxtrot-linked network observable.
IPV464[.]227[.]72[.]253Listed as a Gamaredon-associated network observable.
IPV464[.]7[.]199[.]19New IP observed in DNS lookups for Gamaredon-associated infrastructure.
IPV464[.]94[.]84[.]66Gamaredon-associated IP that domains including innocentmillions[.]ru and langra[.]ru resolved to.
IPV464[.]94[.]85[.]18Observed as an IP resolution during changes in Gamaredon-associated infrastructure.
IPV464[.]94[.]85[.]230Listed as a Gamaredon-associated network observable.
IPV468[.]183[.]201[.]96Listed as a Gamaredon-associated network observable.
SHA2567ad3331be038b43c1a19066f1e4edbe85dfb08596d70774a5e15480394626d39SHA-256 of Dvx.zip, the archive containing the ShadowPad backdoor.
SHA2568b557df773156a87f2fe6bf7bb1b10a690e650c08abb924181165ce82d3fc4afSHA-256 of msimg32.dll, identified in the archive as the ShadowPad backdoor.
SHA256a596d4a1ede0d022d77f0b03c723c7071ffec0e89b35f0d30fb9ff15feeb4969SHA-256 of Packagec.ps1, the script reported used for delivery.
SHA256cf0403934749f9d6cbcc80e38d0fca87f7d9e519d9a9031b1797b5568a8e3534SHA-256 of AK.bat, listed among RedFoxtrot-linked host observables.

MITRE ATT&CK

T1059.001 · PowerShellPackagec.ps1 is identified as a PowerShell script used for delivery.T1566 · PhishingThe article reports Gamaredon used phishing campaigns against targeted entities.T1568.001 · Fast Flux DNSThe article describes Gamaredon-associated flux-like DNS behavior with short TTLs, changing IP resolutions, and wildcard A records.T1574.002 · DLL Side-LoadingThe ShadowPad archive included a legitimate signed executable vulnerable to DLL side-loading, with msimg32.dll identified as the backdoor.

Threat Actors

GamaredonRussian state-linked threat actor; the article states it is also tracked as Primitive Bear.RedFoxtrotSuspected Chinese APT group; the article links the server cluster to infrastructure with overlapping characteristics.Storm WormBotnet cited as an early example of malicious fast-flux use.

Malware

ShadowPadA group of servers linked through a shared TLS certificate, including one that was recently identified communicating with the ShadowPad backdoor.Storm WormOne of the earliest examples of fast flux used in a malicious manner was by the Storm Worm botnet in 2007.

Vendors

Akamaiwe uncovered a set of servers hosted across known VPS providers like The Constant Company, XNNET, Akamai, and Digital Ocean.BL NetworksThe majority were hosted by DigitalOcean, with BL Networks making up a number of the IPs with resolving domains. This reinforces previous reporting that the actors rely on VPS providers.DigitalOceanThe majority were hosted by DigitalOcean, with BL Networks making up a number of the IPs with resolving domains. This reinforces previous reporting that the actors rely on VPS providers.The Constant Companyand JA4X fingerprinting, we uncovered a set of servers hosted across known VPS providers like The Constant Company, XNNET, Akamai, and Digital Ocean.XNNETwe uncovered a set of servers hosted across known VPS providers like The Constant Company, XNNET, Akamai, and Digital Ocean.

Products

NETGATE Amiti Antivirush.exe -- A legitimate NETGATE Amiti Antivirus binary, renamed and used for sideloading

Tools

HuntSQLFigure 4: Results of our HuntSQL query for the suspicious TLS certificate.As we are still tracking this set of servers, we will be withholding detailing specific queries. As we gain additional insight into thisJA4Xfirst seen in late 2024 according to our scan data. Using a combination of certificate details and JA4X fingerprinting, we uncovered a set of servers hosted across known VPS providers like The Constant Company,

Countries

ChinaIn this post, we share recent observations from two distinct infrastructure clusters linked to state-sponsored groups suspected of operating out of Russia and China:IndiaIrelandand what appears to be a mail server for 'OPW'--a name that may reference the Office of Public Works in Ireland, OPW Fueling Components, or an unrelated internal service.RussiaIn this post, we share recent observations from two distinct infrastructure clusters linked to state-sponsored groups suspected of operating out of Russia and China:Ukraine

Industries

Civil societyactive since at least 2013. The group has primarily set its sights on the Ukrainian government and civil society organizations but has also attacked Western government entities, Africa, and NATO member statesGovernmentthreat actor active since at least 2013. The group has primarily set its sights on the Ukrainian government and civil society organizations but has also attacked Western government entities, Africa, and NATOSemiconductorsTelecommunications

Related Articles