Gallmaker: New Attack Group Eschews Malware to Live off the Land

Symantec researchers disclose the 'Gallmaker' campaign, an espionage-focused threat actor active since at least December 2017 that avoids custom malware by using living-off-the-land techniques and publicly available tools. The group gains initial access via DDE-based malicious Office documents, runs PowerShell-based obfuscated shellcode to download Meterpreter reverse_tcp payloads, communicates with identified C2 IPs, targets government/military/embassy victims, and leaves limited disk artifacts to evade detection; the report includes IoCs, filenames, and mitigation guidance.