ArmageddonMalware
RansomwareFrom MISP Galaxy
Last reported 4 months ago, by Sekoia.io2 reports
ATT&CK techniques
5 techniques · each with the sentence it comes from- T1053.005Scheduled Task
“It then establishes persistence by creating a scheduled task to execute this ADS before terminating.”
- T1027.006HTML Smuggling
“Next, it initiates a HTML Smuggling technique with a Base64-encoded RAR archive embedded in its source code, named 2_14_6_1033_09.12.2025.rar and exploiting CVE-2025-8088.”
- T1036Masquerading
“To maintain a resilient connection with C2 server, GammaWorm establishes a persistence mechanism masquerading as a system maintenance tool.”
- T1546.013PowerShell Profile
“…to achieve remote code execution if a file is written to specific locations, such as persistence paths (e.g., Programs\Startup) as PowerShell profile, or by replacing a DLL to exploit a DLL search order hijacking vulnerability.”
- T1684Social Engineering
“…itimate directories, replacing them with malicious LNK shortcut files, and forge a second type of LNK shortcuts that use Ukrainian social engineering lures.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
FSB’s matryoshka #2/3: Gamaredon's Gammaload Malware“As early as 2015, the LookingGlass report Operation Armageddon: Cyber Espionage as a Strategic Component of Russian Modern Warfare noted that parts of the infection chain contained "several observed instances of multistage payloads with up to three levels of nested SFX archives b…”
-
FSB’s matryoshka #1/3: Inside Gamaredon Cyber Operations“This long-term campaign is attributed to Gamaredon (aka ACTINUM, Armageddon, UAC-0010, BlueAlpha), a Russian state-sponsored intrusion-set officially linked by national agencies, such as the Security Service of Ukraine (SSU), to the Russian Federal Security Service (FSB).”
Indicators in its reports
named in the reports above- hxxps://bold.zsjtn41091.workers[.]devin 2 reports
- bold.zsjtn41091.workers[.]devin 2 reports
- mil.gov[.]uain 1 report
- teletype[.]inin 1 report
- lesma[.]euin 1 report
- check-host[.]netin 1 report
- 1794369214b7f62e70a0485e61335c61in 1 report
- hxxp://iiwdsxwamylbwwsoyrmj.supabase[.]co/functions/v1/clever-responder/KokonGoogle_09.12.2025in 1 report
- hxxps://[email redacted][.]co/functions/v1/clever-responder/GurGoogle_09.12.2025/audience/capture.pdfin 1 report
- 8e1624d110c090ff57d4b493a9107c66in 1 report
- hxxps://graph[.]org/in 1 report
- graph[.]orgin 1 report
- 104.194.140[.]6in 1 report
- moment-cat-qld-place.trycloudflare[.]comin 1 report
- shellobject[.]runin 1 report
- hxxps://www.telegram[.]me/s/oberfaririn 1 report
- gov[.]tkin 1 report
- gov[.]skin 1 report
- net[.]uain 1 report
- mfa.gov[.]uain 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.