OldGremlinThreat actor
OldGremlin is a Russian-speaking ransomware group that has been active for several years. They primarily target organizations in Russia, including banks, logistics, industrial, insurance, retail, and IT companies. OldGremlin is known for using phishing emails as an initial infection vector and has developed custom malware for both Windows and Linux systems.From MISP Galaxy
Last reported 4 years ago, by Group-IB2 reports
ATT&CK techniques
6 of 16 · each with the sentence it comes from- T1021.001Remote Desktop Protocol
“Remote Services: Remote Desktop Protocol”
- T1021.002SMB/Windows Admin Shares
“Remote Services: SMB/Windows Admin Shares”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information”
- T1036Masquerading
“This time they played the sanctions card, masquerading as representatives of a Russian financial organization.”
- T1055Process Injection
“Process Injection: Asynchronous Procedure Call”
- T1055.004Asynchronous Procedure Call
“Process Injection: Asynchronous Procedure Call”
What the reports say
2 reports, newest first · the exact sentence from each-
Old Gremlins, new methods“Groups that violated the rule were few and far between, and OldGremlin was one of them.”
-
Big Game Hunting: Now in Russia“Top Russian companies and banks under attack from OldGremlin - a group controlling TinyCryptor ransomware”
Indicators in its reports
named in the reports above- mirfinance[.]orgin 1 report
- hxxps://dl.dropboxusercontent[.]com/s/1956cypkkihawuu/Anketa.docx?dl=0in 1 report
- hxxps://dl.dropboxusercontent[.]com/s/gjyjs0rbtihy7ue/Doc1.dotmin 1 report
- eccbc8[.]comin 1 report
- ns1.eccbc8[.]comin 1 report
- ns2.eccbc8[.]comin 1 report
- ns3.eccbc8[.]comin 1 report
- ns4.eccbc8[.]comin 1 report
- 46.101.113[.]161in 1 report
- 161.35.41[.]9in 1 report
- a3c65c[.]orgin 1 report
- ns1.a3c65c[.]orgin 1 report
- ns2.a3c65c[.]orgin 1 report
- ns3.a3c65c[.]orgin 1 report
- ns4.a3c65c[.]orgin 1 report
- dda9900cefa8cdc8…a6c4cfdc62b2in 1 report
- hxxps://dl.dropboxusercontent[.]com/s/9kng4v6vuq7mq39/akt_sverki.zip?dl=0in 1 report
- hxxps://dl.dropboxusercontent[.]com/s/fq8ew6gl3x46rjc/Akt_sverki.zip?dl=0in 1 report
- hxxps://dl.dropboxusercontent[.]com/s/lf1w11jxp2z0f6s/Akt_sverki.zip?dl=0in 1 report
- hxxps://dl.dropboxusercontent[.]com/s/hy2ub5wnns4c0fi/Akt_sverki.zip?dl=0in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.