Gamaredon campaign abuses LNK files to distribute Remcos backdoor
A campaign targeting users in Ukraine with malicious LNK files has been observed since November 2024. The files, using Russian words related to troop movements as lures, run a PowerShell downloader contacting geo-fenced servers in Russia and Germany. The second stage payload uses DLL side loading to execute the Remcos backdoor. The activity is attributed to the Gamaredon threat actor group with medium confidence. The campaign uses the invasion of Ukraine as a theme in phishing attempts, distributing LNK files disguised as Office documents. The servers used are mostly hosted by GTHost and HyperHosting ISPs. The attack chain involves DLL sideloading to load the Remcos backdoor, which communicates with a C2 server on a specific port.
Pulse ID: 67e6c6b5e3b5eec595438366
Pulse Link: https://otx.alienvault.com/pulse/67e6c6b5e3b5eec595438366
Pulse Author: AlienVault
Created: 2025-03-28 15:56:37
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
