Sekoia Analyzes Gamaredon’s GammaSteel Stealer and DPAPI-Based Staging
Summary
Sekoia researchers analyze Gamaredon’s GammaSteel stealer, describing DPAPI-encrypted PowerShell functions stored in the Windows registry, document collection from drives and USB devices, and exfiltration through cloud storage with C2 and Dead Drop Resolver fallbacks.
Key points
- Researchers report that GammaSteel stages 71 encrypted PowerShell functions in the HKCU\Printers registry key, using Windows DPAPI to bind decryption to the current user’s session.
- The stealer searches user profiles, local and network drives, newly connected USB devices, and files as they are saved or modified.
- It tracks previously exfiltrated files by MD5 hash and uploads selected documents to S3-compatible storage; the analyzed configuration used Tebi[.]io.
- If primary uploads fail, fallback C2 servers can receive stolen files and return VBScript for execution on the compromised host.
- When infrastructure is unavailable, the malware retrieves updated configuration and credentials from Dead Drop Resolvers hosted on public platforms.
- During a month of monitoring, Sekoia says it identified 115 unique IP addresses, four domains, and five sets of S3 credentials linked to the campaign.
- The researchers describe DPAPI-based registry staging as a technique not previously observed in Gamaredon activity; they note similarities to historical InvisiMole behavior but say tool or method sharing is only a possibility.
Article Details
- Attack Vectors
- GammaSteel is delivered as an obfuscated PowerShell script that decodes payloads with Base64 and XOR operations, then stages 71 DPAPI-encrypted functions in the HKCU\Printers registry key.
- The orchestrator runs in hidden PowerShell processes and persists through a command written to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run key.
- The stealer scans local drives and network shares hourly, monitors inserted USB drives, and watches non-USB drives for changes to targeted file types.
- Documents copied from USB drives are placed in a hidden staging directory on the host before exfiltration; MD5 hashes are used to avoid re-uploading previously collected files.
- GammaSteel uploads documents to S3-compatible storage and falls back to HTTP C2 endpoints. It can retrieve updated configuration from Dead Drop Resolvers and execute VBScript found in fallback C2 responses.
- The broader infection chain uses VBScript payloads in NTFS Alternate Data Streams and obfuscates scripts with junk code and changing variables.
- Defensive Notes
- Inspect HKCU\Printers for staged PowerShell functions and investigate the reported Run-key value that launches hidden PowerShell to retrieve and execute the orchestrator.
- Monitor hidden PowerShell and wscript.exe activity, including execution of VBScript recovered from HTTP response bodies.
- Review recurring access to local drives, network shares, USB mass-storage devices, and document files, along with creation of hidden staging directories and local MD5 tracking files.
- Investigate outbound HTTP PUT or POST activity associated with document uploads and requests to the reported fallback C2 and Dead Drop Resolver resources.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | justsstop[.]ru | Operator-controlled fallback C2 domain used to receive exfiltrated documents and return VBScript for execution. |
| DOMAIN | myvnc[.]com | Domain observed in the campaign’s initial-access infrastructure using No-IP DDNS. |
| DOMAIN | norosta[.]ru | Actor-controlled domain identified as resolving C2 or staging infrastructure. |
| DOMAIN | selltosell[.]ru | Actor-controlled domain with randomized subdomains used to resolve C2 or staging infrastructure. |
| DOMAIN | serveftp[.]com | Domain observed in the campaign’s initial-access infrastructure using No-IP DDNS. |
| DOMAIN | serveirc[.]com | Domain observed in the campaign’s initial-access infrastructure using No-IP DDNS. |
| DOMAIN | webhop[.]me | Domain observed in the campaign’s initial-access infrastructure using No-IP DDNS. |
| IPV4 | 165[.]22[.]170[.]129 | Hardcoded fallback C2 IP used to receive exfiltrated documents and return VBScript for execution. |
| URL | hxxps[:]//api[.]telegra[.]ph/getPage/Hello-01-23-161 | Dead Drop Resolver API resource used by the stealer to retrieve configuration data. |
| URL | hxxps[:]//mastodon[.]social/api/v1/statuses/115942411657067215 | Dead Drop Resolver API resource used to retrieve updated C2 and S3 configuration. |
| URL | hxxps[:]//rentry[.]co/hwzrmfkx | Dead Drop Resolver page hosting network indicators and S3 credentials. |
| URL | hxxps[:]//write[.]as/api/posts/1nei1af6dnw8q | Dead Drop Resolver API resource used by the stealer to retrieve configuration data. |
MITRE ATT&CK
T1005 · Data from Local SystemThe stealer searches local drives and collects targeted user documents for exfiltration.T1025 · Data from Removable MediaA USB event listener locates targeted files on inserted removable drives and copies them for exfiltration.T1027 · Obfuscated Files or InformationThe article describes Base64 and XOR obfuscation, randomized variables, and junk code in the campaign's scripts.T1039 · Data from Network Shared DriveThe stealer enumerates network drives and shares and collects targeted files from them.T1041 · Exfiltration Over C2 ChannelWhen cloud-storage uploads fail, GammaSteel sends stolen documents to fallback C2 servers over HTTP.T1059.001 · PowerShellGammaSteel uses PowerShell to stage and execute its functions, including in hidden child processes.T1059.005 · Visual BasicThe fallback C2 response can deliver VBScript that the malware writes to a temporary file and executes with wscript.exe.T1071.001 · Web ProtocolsThe malware uses HTTP GET, PUT, and POST requests to retrieve configuration, upload documents, and communicate with fallback C2.T1083 · File and Directory DiscoveryThe malware enumerates profiles, drives, and files, and recursively watches drives for changes to targeted documents.T1102.001 · Dead Drop ResolverThe stealer queries public Dead Drop Resolver resources to recover C2 and S3 configuration.T1112 · Modify RegistryThe malware stages encrypted functions and updates configuration in the Windows registry, including HKCU\Printers.T1140 · Deobfuscate/Decode Files or InformationThe script decodes Base64 strings and applies XOR operations to unpack embedded code into memory.T1547.001 · Registry Run Keys / Startup FolderThe malware writes a command to the current user's Run registry key to relaunch the orchestrator at startup.T1564.004 · NTFS File AttributesThe article reports that the broader infection chain stores VBScript functions in NTFS Alternate Data Streams attached to user profiles or temporary directories.T1567.002 · Exfiltration to Cloud StorageGammaSteel uploads stolen documents to S3-compatible cloud storage, including the analyzed configuration pointing to Tebi.io.
Threat Actors
ArmagedonThe report identifies Armagedon as an alias for Gamaredon, which it describes as conducting persistent cyberespionage operations targeting Ukraine.GamaredonThe report describes Gamaredon as conducting persistent cyberespionage operations targeting Ukraine, including government, military, and critical-infrastructure networks; it identifies the group as FSB-operated.InvisiMoleThe report describes InvisiMole as an FSB-linked intrusion set previously observed cooperating with Gamaredon and notes a possible overlap in operational methods; it suggests, but does not confirm, tool or methodology sharing.UAC-0010The report identifies UAC-0010 as an alias for Gamaredon, which it describes as conducting persistent cyberespionage operations targeting Ukraine.
Malware
Vendors
Cloudflarebe invisible: by hiding inside legitimate Windows features and abusing trusted platforms like Telegram, Cloudflare, and standard cloud storage, Gamaredon leaves almost no trace on infected machines. Once inside aNo-IPA part of the infrastructure relies on Dynamic DNS (DDNS) services provided by No-IP. Domains such as serveirc[.]com, webhop[.]me, serveftp[.]com, and myvnc[.]com are primarily observed during the initial access phase,SupabaseFurthermore, Gamaredon leverages Supabase to host its payloads, exploiting the platform's positive reputation to evade basic security filters. As a legitimate Backend-as-a-Service provider, Supabase offers anTebi.ioMD5 hashes. The data is then systematically uploaded to legitimate S3-compatible cloud storage (Tebi.io).
Products
Mastodonexecutes HTTP GET requests four hardcoded URLs hosted on Telegra.ph, Write.as, Rentry[.]co, and Mastodon. The function terminates upon the first successful retrieval of valid configuration data. Each of theseMicrosoft WindowsThe infection chain is designed to be invisible: by hiding inside legitimate Windows features and abusing trusted platforms like Telegram, Cloudflare, and standard cloud storage, Gamaredon leaves almost no trace onPowerShellrequests from GammaLoad analysed in the second report of this series. The payload is an obfuscated PowerShell script that acts as a dropper for the stealer. The code employs Base64 encoding combined with a XORTelegra.phThe script sequentially executes HTTP GET requests four hardcoded URLs hosted on Telegra.ph, Write.as, Rentry[.]co, and Mastodon. The function terminates upon the first successful retrieval of valid configuration data.Telegramto be invisible: by hiding inside legitimate Windows features and abusing trusted platforms like Telegram, Cloudflare, and standard cloud storage, Gamaredon leaves almost no trace on infected machines. OnceWrite.asThe script sequentially executes HTTP GET requests four hardcoded URLs hosted on Telegra.ph, Write.as, Rentry[.]co, and Mastodon. The function terminates upon the first successful retrieval of valid configuration data.
Countries
Russiaspecialized in long-term and persistent intrusion operations targeting Ukraine. Officially operated by Russia's FSB, the group is focusing government, military, and critical infrastructure networks, and is stillUkraineis a cyberespionage group specialized in long-term and persistent intrusion operations targeting Ukraine. Officially operated by Russia's FSB, the group is focusing government, military, and critical
Industries
Critical infrastructureUkraine. Officially operated by Russia's FSB, the group is focusing government, military, and critical infrastructure networks, and is still actively operating at the time of this publication.Governmentintrusion operations targeting Ukraine. Officially operated by Russia's FSB, the group is focusing government, military, and critical infrastructure networks, and is still actively operating at the time of thisMilitaryoperations targeting Ukraine. Officially operated by Russia's FSB, the group is focusing government, military, and critical infrastructure networks, and is still actively operating at the time of this publication.