OldGremlin, a threat actor targeting Russian organizations with phishing emails since 2020

For a detailed advisory, download the pdf file here

After almost a year, OldGremlin made a comeback in March 2022 by resuming their malicious email campaigns against two Russian organizations. Over the last two years, OldGremlin has carried out 13 malicious email campaigns aimed at banks, industrial enterprises, medical organizations, and software developers. OldGremlin is known to carry out multi-stage targeted attacks using sophisticated tactics and techniques via ransomwares and malwares such as TinyCryptor and TinyFluff.

The attack chain began with OldGremlin sending a phishing email impersonating a senior accountant at a Russian financial organization, informing their targets of new sanctions that would shut down Visa and Mastercard payment systems in the region. This email directed the user to a malicious Dropbox document that downloads TinyFluff, a backdoor that launches the Node.js interpreter and grants the attacker remote access to the target system. After installing TinyFluff, OldGremlin advances to the reconnaissance stage. The attacker can stay inside the compromised network for months before launching the final stage of the attack: delivering TinyCrypt/TinyCryptor, the group’s custom ransomware payload.

The MITRE ATT&CK TTPs used by OldGremlin are:

TA0043: Reconnaissance

TA0042: Resource Development

TA0001: Initial Access      

TA0002: Execution      

TA0005: Defense Evasion 

TA0011: Command and Control

T1592: Gather Victim Host Information    

T1592.001: Gather Victim Host Information: Hardware

T1592.002: Gather Victim Host Information: Software

T1590.005: Gather Victim Network Information: IP Addresses

T1583: Acquire Infrastructure: Domains

T1583.001: Acquire Infrastructure: Domains

T1583.002: Acquire Infrastructure: DNS Server

T1587: Develop Capabilities

T1587.001: Develop Capabilities: Malware

T1585: Establish Accounts

T1585.002: Establish Accounts: Email Accounts

T1566: Phishing

T1566.002: Phishing: Spearphishing Link

T1059: Command and Scripting Interpreter

T1059.007: Command and Scripting Interpreter: JavaScript

T1059.003: Command and Scripting Interpreter: Windows Command Shell

T1204: User Execution

T1204.001: User Execution: Malicious Link

T1204.002: User Execution: Malicious File

T1027: Obfuscated Files or Information

T1071: Application Layer Protocol

T1071.001: Application Layer Protocol: Web Protocols

T1071.004: Application Layer Protocol: DNS

T1132: Data Encoding

T1132.001: Data Encoding: Standard Encoding

T1568: Dynamic Resolution

T1568.002: Dynamic Resolution: Domain Generation Algorithms

T1573: Encrypted Channel

T1573.001: Encrypted Channel: Symmetric Cryptography  T1572: Protocol Tunneling

Actor Detail

Indicators of Compromise (IoCs)

References