OldGremlin, a threat actor targeting Russian organizations with phishing emails since 2020
OldGremlin, a threat actor targeting Russian organizations with phishing emails since 2020
THREAT LEVEL: Amber.
For a detailed advisory, download the pdf file here
After almost a year, OldGremlin made a comeback in March 2022 by resuming their malicious email campaigns against two Russian organizations. Over the last two years, OldGremlin has carried out 13 malicious email campaigns aimed at banks, industrial enterprises, medical organizations, and software developers. OldGremlin is known to carry out multi-stage targeted attacks using sophisticated tactics and techniques via ransomwares and malwares such as TinyCryptor and TinyFluff.
The attack chain began with OldGremlin sending a phishing email impersonating a senior accountant at a Russian financial organization, informing their targets of new sanctions that would shut down Visa and Mastercard payment systems in the region. This email directed the user to a malicious Dropbox document that downloads TinyFluff, a backdoor that launches the Node.js interpreter and grants the attacker remote access to the target system. After installing TinyFluff, OldGremlin advances to the reconnaissance stage. The attacker can stay inside the compromised network for months before launching the final stage of the attack: delivering TinyCrypt/TinyCryptor, the group’s custom ransomware payload.
The MITRE ATT&CK TTPs used by OldGremlin are:
TA0043: Reconnaissance
TA0042: Resource Development
TA0001: Initial Access
TA0002: Execution
TA0005: Defense Evasion
TA0011: Command and Control
T1592: Gather Victim Host Information
T1592.001: Gather Victim Host Information: Hardware
T1592.002: Gather Victim Host Information: Software
T1590.005: Gather Victim Network Information: IP Addresses
T1583: Acquire Infrastructure: Domains
T1583.001: Acquire Infrastructure: Domains
T1583.002: Acquire Infrastructure: DNS Server
T1587: Develop Capabilities
T1587.001: Develop Capabilities: Malware
T1585: Establish Accounts
T1585.002: Establish Accounts: Email Accounts
T1566: Phishing
T1566.002: Phishing: Spearphishing Link
T1059: Command and Scripting Interpreter
T1059.007: Command and Scripting Interpreter: JavaScript
T1059.003: Command and Scripting Interpreter: Windows Command Shell
T1204: User Execution
T1204.001: User Execution: Malicious Link
T1204.002: User Execution: Malicious File
T1027: Obfuscated Files or Information
T1071: Application Layer Protocol
T1071.001: Application Layer Protocol: Web Protocols
T1071.004: Application Layer Protocol: DNS
T1132: Data Encoding
T1132.001: Data Encoding: Standard Encoding
T1568: Dynamic Resolution
T1568.002: Dynamic Resolution: Domain Generation Algorithms
T1573: Encrypted Channel
T1573.001: Encrypted Channel: Symmetric Cryptography T1572: Protocol Tunneling
Actor Detail
Indicators of Compromise (IoCs)
References
