Gamaredon_Group__2020__Gamaredon_group_grows_its_game_WeLiveSecurity.pdf

This ESET analysis details the Gamaredon APT’s active spearphishing campaigns and post-compromise toolset: an Outlook VBA module that abuses compromised mailboxes to send malicious attachments, Office macro and remote-template injection modules for lateral movement and persistence, multiple downloader variants (including an on-host C# compiler and GitHub-hosted payload retrieval), and file-stealer/backdoor implants that enumerate and exfiltrate Office documents; the report also lists IoCs, C2 domain patterns and mapped MITRE ATT&CK techniques.