Gamaredon Group tools can delete files used during an operation.(Citation: TrendMicro Gamaredon April 2020)(Citation: Symantec Shuckworm January 2022)(Citation: CERT-EE Gamaredon January 2021)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1120|Peripheral Device Discovery|

Gamaredon Group tools have contained an application to check performance of USB flash drives.

Gamaredon Group has also used malware to scan for removable drives.(Citation: Palo Alto Gamaredon Feb 2017)(Citation: ESET Gamaredon June 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1041|Exfiltration Over C2 Channel|A

Gamaredon Group file stealer can transfer collected files to a hardcoded C2 server.(Citation: Palo Alto Gamaredon Feb 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1025|Data from Removable Media|A

Gamaredon Group file stealer has the capability to steal data from newly connected logical volumes on a system, including USB drives.(Citation: Palo Alto Gamaredon Feb 2017)(Citation: ESET Gamaredon June 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

Gamaredon Group has used HTTP and HTTPS for C2 communications.(Citation: Palo Alto Gamaredon Feb 2017)(Citation: TrendMicro Gamaredon April 2020)(Citation: ESET Gamaredon June 2020)(Citation: Symantec Shuckworm January 2022)(Citation: CERT-EE Gamaredon January 2021)(Citation: Unit 42 Gamaredon February 2022)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Gamaredon Group has used various batch scripts to establish C2 and download additional files.