Gamaredon Group has incorporated dynamic DNS domains in its infrastructure.(Citation: Unit 42 Gamaredon February 2022)|
|mitre-attack|enterprise-attack|PRE|T1608.001|Upload Malware|

Gamaredon Group has registered domains to stage payloads.(Citation: Microsoft Actinium February 2022)(Citation: Unit 42 Gamaredon February 2022)|
|mitre-attack|enterprise-attack|PRE|T1583.001|Domains|

Gamaredon Group has registered multiple domains to facilitate payload staging and C2.(Citation: Microsoft Actinium February 2022)(Citation: Unit 42 Gamaredon February 2022)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Gamaredon Group has used obfuscated PowerShell scripts for staging.(Citation: Microsoft Actinium February 2022)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS|T1485|Data Destruction|

Gamaredon Group has used tools to delete files and folders from victims' desktops and profiles.(Citation: CERT-EE Gamaredon January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1491.001|Internal Defacement|

Gamaredon Group has left taunting images and messages on the victims' desktops as proof of system access.(Citation: CERT-EE Gamaredon January 2021)|
|mitre-attack|enterprise-attack|Windows|T1047|Windows Management Instrumentation|

Gamaredon Group has used WMI to execute scripts used for discovery.(Citation: CERT-EE Gamaredon January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

Gamaredon Group has used tools to enumerate processes on target hosts including Process Explorer.(Citation: Symantec Shuckworm January 2022)(Citation: Unit 42 Gamaredon February 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1021.005|VNC|