Trident Ursa aka Gamaredon APT Attack Detection: Russia-Backed Hackers Escalate Offensive Activity by Targeting a Petroleum Refinery in a NATO Country 

Since russia’s full-scale invasion of Ukraine in February 2022, the infamous Trident Ursa russia-affiliated hacking group also tracked as Armageddon APT aka Gamaredon or UAC-0010 has been launching its offensive operations targeting Ukraine and its allies. For over ten months, the hacking collective has performed a series of phishing cyber attacks covered in the corresponding CERT-UA alerts and is continuously escalating its malicious activity. 

Cybersecurity researchers keep a close eye on the offensive operations of the UAC-0010 group, which remains one of the most intrusive and focused APTs targeting Ukraine and its allies on the cyber frontline. With Trident Ursa attempting to target a large petroleum refining company in a NATO country, cyber defenders need to be armed with proactive defensive capabilities to timely identify the intrusion. 

Detect Trident Ursa (UAC-0010) Adversary Activity

The malicious activity of the russia-backed cyber-espionage group mainly known as Armageddon APT, Gamaredon, or Trident Ursa is currently on the rise in the cyber threat landscape. SOC Prime’s Detection as Code platform is designed to help defenders from across the globe proactively thwart attacks and help the entire community gain a competitive advantage in the ongoing cyber war. SOC Prime struggles on the cyber frontline of the war helping Ukraine and its allies protect the country from russian aggression while enhancing the defensive capabilities with Sigma and MITRE ATT&CK® technologies. 

To help organizations timely identify the Trident Ursa offensive activity, SOC Prime Platform has released a set of dedicated Sigma rules developed by our Threat Bounty content contributors, Wirapong Petshagun and Kaan Yeniyol. Follow the link below to immediately reach these algorithms mapped to the latest MITRE ATT&CK framework v12 and delve into their cyber threat context:

Sigma rules to detect the latest Trident Ursa malicious activity

The Sigma rule by Wirapong Petshagun addresses the Command and Control tactic with Application Layer Protocol (T1071) used as its primary technique, while the detection algorithm crafted by Kaan Yeniyol addresses the Execution tactic and the corresponding Scheduled Task/Job (T1053) technique. 

SOC Prime Platform also curates another Sigma rule to detect the latest malicious campaigns of Gamaredon APT aka UAC-0010. This detection written by our prolific Threat Bounty developer, Kyaw Pyiyt Htet (Mik0yan) addresses the Persistence and Defense Evasion tactics represented by the corresponding Boot or Logon Autostart Execution (T1547) and Modify Registry (T1112) ATT&CK techniques. 

All Sigma rules above can be leveraged across 15+ SIEM, EDR, XDR solutions, and data analytics platforms. 

Striving to master your Sigma and ATT&CK skills while contributing to a safer future? Join Threat Bounty Program, which enables aspiring content authors to code a future CV, hone professional skills through shared expertise, and monetize their detection content. 

To reach the comprehensive list of Sigma rules for the detection of UAC-0010 adversary activity, click the Explore Detections button below. Security engineers can check out relevant detection algorithms filtered by the custom tag “UAC-0010” and explore metadata, such as ATT&CK context, CTI links, binaries, and more. 

Explore Detections

Since the outbreak of the full-scale war in Ukraine, the country has been under constant cyber attacks by the russia-affiliated hacking group known to cyber defenders under a variety of monikers, including Armageddon APT, Gamaredon, Trident Ursa, Shuckworm, UAC-0010, and Primitive Bear. According to the Security Service of Ukraine, the hacking collective is linked to russia’s Federal Security Service and aims to launch intelligence and subversive activities against Ukraine and NATO allies in the cyber domain. 

The APT group has been actively exploiting the phishing attack vector. CERT-UA cybersecurity researchers constantly strive to draw the attention of cyber defenders to the ever-increasing malicious activity of this group they identify as UAC-0010. Threat actors launched a wave of phishing attacks mainly targeting Ukrainian state bodies in April and May, in which they took advantage of GammaLoad.PS1 malware and its upgraded version, GammaLoad.PS1_v2. In August 2022, they leveraged GammaLoad and GammaSteel payloads to infect the compromised systems in another phishing campaign. In a more recent November attack, the hacking collective was observed massively spreading spoofed emails with the sender disguised as the State Special Communications Service of Ukraine exploiting a malicious attachment with an HTML file that triggered an infection chain.

The latest report by Palo Alto Networks Unit 42 gains insights into growing threats attributed to the adversary activity of Trident Ursa. Based on their research, the Unit 42 team has been expanding its scope of attacks beyond Ukraine. At the turn of September 2022, threat actors made an unsuccessful attempt to compromise a large-scale petroleum refining company in a country, which belongs to NATO members, thus escalating a conflict on the cyber frontline. 

The notorious russia-affiliated hacking group is posing daunting challenges to defensive forces, continuously upgrading their adversary TTPs and enhancing detection evasion techniques. For instance, threat actors apply the fast flux DNS technique to amplify the resilience of their malicious operations and hinder anti-malware analysis procedures. Other adversary techniques used by Trident Ursa include bypassing DNS via legitimate web services and Telegram Messenger and hiding true IP assignments by using subdomains for their malicious operations rather than root domains.

Trident Ursa commonly applies a set of multiple adversary methods to initially compromise the targeted systems via VBScript code and frequently delivers malicious content through HTML file attachments used as phishing lures. 

As potential mitigation measures, Unit 42 recommends implementing a reliable DNS security solution and thoroughly monitoring all network traffic communicating with AS 197695.

Trident Ursa aka Gamaredon APT is an adaptive hacking collective continuously expanding its adversary toolkit, leveraging novel obfuscation techniques, and taking advantage of new domains, which remains a threat to Ukraine and its allies. To proactively withstand offensive capabilities, explore our Sigma Rules Search Engine and equip yourself with the most relevant detections against current and emerging threats along with in-depth cyber threat intelligence.