Gamaredon Group has removed security settings for VBA macro execution by changing registry values

Gamaredon Group has used an Outlook VBA module on infected systems to send phishing emails with malicious attachments to other employees within the organization.(Citation: ESET Gamaredon June 2020)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Containers,IaaS|T1562.001|Disable or Modify Tools|

Gamaredon Group has delivered macros which can tamper with Microsoft Office security settings.(Citation: ESET Gamaredon June 2020)   |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|

Gamaredon Group macros can scan for Microsoft Word and Excel files to inject with additional malicious macros.

Gamaredon Group has also used its backdoors to automatically list interesting files (such as Office documents) found on a system.(Citation: ESET Gamaredon June 2020)(Citation: Unit 42 Gamaredon February 2022)    |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.001|Binary Padding|

Gamaredon Group has obfuscated .NET executables by inserting junk code.(Citation: ESET Gamaredon June 2020)   |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.004|Compile After Delivery|

Gamaredon Group has compiled the source code for a downloader directly on the infected system using the built-in

Gamaredon Group has created scheduled tasks to launch executables after a designated number of minutes have passed.(Citation: ESET Gamaredon June 2020)(Citation: CERT-EE Gamaredon January 2021)(Citation: Microsoft Actinium February 2022) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102|Web Service|

Gamaredon Group has used GitHub repositories for downloaders which will be obtained by the group's .NET executable on the compromised system.(Citation: ESET Gamaredon June 2020)    |
|mitre-attack|enterprise-attack|Windows|T1559.001|Component Object Model|