Playing defense against Gamaredon Group

Elastic Security tracked a multi-month Gamaredon Group campaign targeting Ukrainian government officials that uses spearphishing documents with remote template injection to load macro-enabled templates hosted on Dynamic DNS. The macros disable macro security, write a persistent VBScript to the Startup folder which performs HTTP-based callbacks to Dynamic DNS C2s and can download/reassemble additional payloads; researchers also observed artifacts related to the Pteranodon backdoor. The report provides technical analysis, IOC listings (hashes, domains, IPs, URIs), and EQL detection/hunting queries for Dynamic DNS, template injection, malicious registry changes, and startup persistence.