Gamaredon campaign abuses LNK files to distribute Remcos backdoor
ID: a032d507-b324-5002-b58e-a5286b3febff
STIX ID: report--a032d507-b324-5002-b58e-a5286b3febff
Feed Name: Cisco Talos
Threat Score
Cisco Talos documents an ongoing Gamaredon campaign (since at least Nov 2024) targeting Ukrainian users with war-themed LNK-based phishing lures that run PowerShell to download a ZIP containing a DLL-sideloaded Remcos backdoor; the report provides TTPs, hosting infrastructure (servers in Russia and Germany, ISPs GTHost/HyperHosting), a C2 IP (146.185.233.96:6856), sample filenames, and IOCs in a GitHub repository.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.