Full Report
Russian-speaking ransomware gang OldGremlin resumes attacks in Russia
Analysis Summary
# Threat Actor: OldGremlin
## Attribution & Identity
* **Name/Alias:** OldGremlin.
* **Identification:** A Russian-speaking ransomware group.
* **Associations:** Known for being one of the few ransomware gangs that actively targets organizations within Russia, despite the common "no-target-CIS" (Commonwealth of Independent States) rule followed by many other Russian-speaking cybercriminals.
## Activity Summary
OldGremlin has resumed active operations after a period of relative silence. The recent campaign involved sophisticated spear-phishing tactics designed to compromise corporate networks in Russia. The group continues to utilize custom malware and multi-stage infection chains to gain initial access, move laterally, and eventually deploy ransomware for financial extortion.
## Tactics, Techniques & Procedures
* **Initial Access via Spear-Phishing:** Sending malicious emails with ZIP/RAR attachments containing LNK files.
* **Malicious LNK Files:** Using shortcut files to execute commands via `%ComSpec%` (Command Prompt).
* **WebDAV for Payload Delivery:** Using the `net use` command to connect to remote WebDAV shares (via `DavWWWRoot`) to download and execute secondary payloads without saving them directly to disk initially.
* **Decoy Documents:** Opening legitimate-looking `.docx` files (e.g., "Consultant" contract templates) to distract the user while malware runs in the background.
* **Execution:** Using `start /b` to execute malicious binaries silently.
* **Custom Backdoors:** Deployment of "TinyFluff," a lightweight backdoor used for persistence and further command execution.
**MITRE ATT&CK IDs (Inferred from TTPs):**
* **T1566.001:** Phishing: Spear-phishing Attachment
* **T1204.002:** User Execution: Malicious File
* **T1021.002:** Remote Services: SMB/Windows Admin Shares (WebDAV/Net Use)
* **T1203:** Exploitation for Client Execution
* **T1105:** Ingress Tool Transfer
## Targeting
* **Sectors:** Likely legal, financial, and professional services (based on the "Consultant" and "Akt_sverki" file names).
* **Geography:** Russia (Primary focus).
* **Victims:** Russian organizations and corporate entities.
## Tools & Infrastructure
* **Malware Families:**
* **TinyFluff:** A custom backdoor (PDB path: `Z:\WebFluffPP\Release\TinyFluff.pdb`).
* **Infrastructure:**
* **C2/WebDAV IP:** `192.248.176[.]138`
* **Malicious Files:**
* `Akt_sverki_Consultant.zip`
* `DopSog_Consultant.docx.lnk`
* `tf.exe` (TinyFluff)
* `s.txt`
## Implications
OldGremlin represents a significant threat to Russian infrastructure due to their willingness to break the "gentleman's agreement" among Russian-speaking actors to avoid domestic targets. Their TTPs indicate a high level of technical proficiency, particularly in utilizing built-in Windows features (Living-off-the-Land) and WebDAV to bypass traditional perimeter defenses. Their return suggests a continued and evolving threat to the Russian corporate landscape.
## Mitigations
* **Disable WebDAV:** Block outgoing WebDAV requests at the firewall/proxy level to prevent connection to external malicious shares.
* **Attachment Filtering:** Block or scrutinize ZIP/RAR archives containing LNK files at the email gateway.
* **Endpoint Monitoring:** Monitor for `net use` commands targeting external IP addresses and unexpected executions via `%ComSpec%`.
* **User Training:** Educate employees on the dangers of opening unsolicited attachments, specifically those mimicking accounting or legal documents (e.g., "Akt sverki").
* **AppLocker/WDAC:** Implement application whitelisting to prevent the execution of unauthorized binaries like `tf.exe`.