# Post-Gamaredon-Feb-2022 blog release IoC update
# 16FEB2022
# note that clustering may not be authoritative


# LNK files
# These were not observed in earlier campaigns and seem to be a new dropper technique

19888c043afde1f63f25a807192170bc65377e6c89f693ad7af70c0a03a349ed
60539634489764d9e590433ef632727aa465075befcb4f2d4f60405c0f8e600c
be7d70fb705c74f2de86db2b34f3e7587e5b3ded2d02eaad48fcfee426379372
782a8cc34746ca1ffc7cd83a9cc4cd64c60de2e69622a06d2a01792df2e2573c
7c2c376300c1fc562521196458c2594edac152f1ad944c517927b5a12193980c
3d80541e59b4bedac6bd275514c0941b1478d62d6ef8b8560720d05a83c0a910


# Cluster 1 - new domains

maonas.ru
nastorlam.ru
nokitrav.ru
postoral.ru
rebatok.ru
sadotra.ru
lotorsas.ru
diletras.ru
distorhan.ru
filopar.ru
firatoska.ru
gartisop.ru
giltorad.ru
hikorto.ru
jenipot.ru
jistarka.ru
jolopar.ru
koloparto.ru
koutora.ru
mavzolit.ru
milotor.ru
potrahid.ru
shaparto.ru
skripotan.ru
somebodar.ru
turikar.ru
vartogal.ru
bolotran.ru
corintar.ru
drumtar.ru
filikato.ru
fortuskan.ru
giboltar.ru
giroed.ru
golitus.ru
hikorta.ru
holotras.ru
hotilar.ru
kassanfo.ru
kolopart.ru
kolotara.ru
lestori.ru
mafdis.ru
mirtokla.ru
nintara.ru
ringali.ru
tirotar.ru
videotri.ru
vivaldar.ru


# Cluster 1b - linked by WHOIS message-yandex.ru@mail.ru
# Note that this email links to cluster 1 historic origins
# also seen in domains back to 2017
# These are active registrations as of Feb 2022. Approximately 200 expired not listed.

emailinfo.site
downloadfiles.website
email-inbox.site
ukrnet.site
settings-ukr.net
email-smtp.online
assasysa.online
eyeofra.online
email-info.online
acridoxena.online
hewaniana.online
erythrocephala.online
acantholyda.online
severodoneck.site
admin-gmail.online
account-google.site
file-check.site
sebaer.xyz
triturus.xyz
taphrometopon.xyz
splendensi.xyz
schrenchi.xyz
salamandras.xyz
rutilus.xyz
reticulatus.xyz
pugnax.xyz
molurus.xyz
maculosa.xyz
lineolatum.xyz
glanisa.xyz
cristatus.xyz
chaetodon.xyz
bettar.xyz
mesogonistius.xyz
temporaria.xyz
reinvardtii.xyz
macropodus.xyz
lotari.xyz
fluviatilis.xyz
ridibunda.xyz
ranar.xyz
mystaceus.xyz
arvalis.xyz
carassiusis.xyz
phyllomedusa.xyz
hypochondralis.xyz
gastrotheca.xyz
callichthys.xyz
sclerops.xyz
phrynocephalus.xyz
ophisaurusis.xyz
niloticu.xyz
marsupiata.xyz
jordanella.xyz
igneus.xyz
hylar.xyz
gibelio.xyz
geophagusi.xyz
gasterosteus.xyz
floridae.xyz
crocodilus.xyz
carassiuss.xyz
caimana.xyz
brasiliensisi.xyz
bombinators.xyz
avratus.xyz
auratus.xyz
apusa.xyz
aculeatus.xyz
ua-email.press
rhinoderma.xyz
pipasa.xyz
ophisaurus.xyz
obstetricans.xyz
darvini.xyz
bufol.xyz
bombinator.xyz
apusi.xyz
alytes.xyz
trichopodus.xyz
gavialis.xyz
trichopterus.xyz
leeri.xyz
eversmanni.xyz
scincus.xyz
rhodeus.xyz
nemachilus.xyz
murinus.xyz
misgurnus.xyz
lebetina.xyz
horridus.xyz
gymnodactylus.xyz
griseus.xyz
gangeticus.xyz
fragilis.xyz
fossilis.xyz
crossobamon.xyz
caspius.xyz
berus.xyz
barbatulus.xyz
anguisa.xyz
amarus.xyz
ambystoma.xyz
alligatori.xyz
agamat.xyz
acaciana.xyz
adonisis.xyz
bartli.xyz
achilleas.xyz
camphorat.xyz
acorusis.xyz
willder.xyz
wallich.xyz
vernalisa.xyz
senegala.xyz
precatoriusis.xyz
millefolium.xyz
ferrox.xyz
cynapiuma.xyz
calamusi.xyz
betulina.xyz
barosma.xyz
aethusas.xyz
adonisi.xyz
abrusa.xyz
anamirtat.xyz
althaean.xyz
silvestris.xyz
occidentale.xyz
montanar.xyz
macrotomias.xyz
hypogaeat.xyz
cotular.xyz
cephalotes.xyz
catechur.xyz
arvensis.xyz
anthriscus.xyz
alpiniar.xyz
artemisian.xyz
absinthiuma.xyz
oleifera.xyz
juncear.xyz
hiemalis.xyz
papayana.xyz
kyiv-mail.site
maculatum.xyz
claviceps.xyz
autumnale.xyz
fionar.xyz
eluteria.xyz
coriandrum.xyz
settings-google.site
cyminum.xyz
dracod.xyz
cuminum.xyz
calamuss.xyz
duboisia.xyz
dipterocarpus.xyz
cardamomum.xyz
capillaceum.xyz
buhse.xyz
boiss.xyz
aspidium.xyz
ammoniacum.xyz
blockpost.space
blockpost.website
blockpost.site
gelsemium.xyz
canadensis.website
barbadense.space
abyssinica.website
bitsbitsk.space
bitsbitsi.space
bitsbitsl.space
bitsbitsc.space
bitsbitsd.space
bitsbitsb.space
bitsbitsa.space
metrika.site
ardinvest.site
bitsadmin4.space
email-gov.site
mil-gov.site
bitsadmin3.space
adblocked.space
bitsadmin2.space


# Cluster 4 - from Microsoft MSTIC Report
# comparable to cluster 3
artisola.ru
lotorgas.ru
gitrostan.ru


# Cluster 5 - from Microsoft MSTIC Report
# Used by PS malware

retarus.ru
calendas.ru
corolain.ru
goloser.ru
alacritas.ru


# Cluster 6 - from Microsoft MSTIC report (older)
# Word docs

acetica.online
mail-check.ru
word-expert.online


# Cluster 7
# Has links to Cluster 1 but appears to be a unique sub-cluster

libellus.ru
barbatas.online
floundera.online
plaicer.ru
barbatas.ru
ferruminatio.ru
privigna.online
mullus.online
sardanal.ru
puppis.ru
goatfish.ru
libellus.online
mulleti.ru
puppis.online
tectaconstrata.online
barbatam.online
mullus.ru
barbatus.online
ferruminatio.online
sardanal.online
privigna.ru
tectaconstrata.ru


# More cluster 7 from Pivot on WHOIS tank-bank15@yandex.ru +7.9789224690

solerat.online
plaicer.online
mulleti.online
goatfish.online
flatfisha.online
bonitol.online


# Cluster 8
# Lone domain - may find links with some more history

neslovo.ru


# Cluster 9
# Only cluster observed still using some NoIP DDNS domains
# Also not using reg.ru for hosting

coagula.online
phymateus.online
tortunas.ru
upload-dt.hopto.org
upload-lk.hopto.org
up-dot.hopto.org
up-lnk.hopto.org


# Cluster 9 WHOIS Pivot macrobit@inbox.ru +7.9789224559

abrumpere.online
acanthophis.online
acetobacter.online
achalinus.online
acrididae.online
agaricusa.online
albatrellus.online
alburnus.online
alicui.online
anisoptera.online
anolis.online
antarcticus.online
apaturinae.online
apidaet.online
apoxipodes.online
arachnidas.online
archaicus.online
archiepiscopus.online
arctiidae.online
asilidae.online
asymmetria.online
atlanticos.site
babylont.online
bacilluse.online
biblidinae.online
blaberidae.online
blattodea.online
boniton.site
botaurus.online
brachycera.online
burhinus.online
campestri.online
carinatus.online
carolinensis.online
cerambycidae.online
cereusi.online
chelicerata.online
cichlasoma.online
ciconiat.online
circulas.online
clonorchis.online
clupeonella.online
coeruleus.online
coleopteras.online
coliadinae.online
cololabis.online
conscindere.online
corvusi.online
cultiventris.online
cyrestinae.online
danainae.online
decursio.online
differre.online
difformis.online
dionysi.online
dipteran.online
discedere.online
discouti.online
discrepare.online
disjungere.online
diversiformis.online
dividere.online
email-online.site
empusidae.online
emysi.online
eryxis.online
eurypterida.online
extrado.online
exundare.online
facetum.online
fanniidae.online
fasciolas.online
felineus.online
flatfish.site
flounder.site
fnhn.online
fnrn.online
formosanus.online
fossor.online
goatfish.site
golintras.site
gonepteryx.online
gorimana.site
gov-ua.pw
graeca.online
graphiuma.online
graphosoma.online
gromphadorhina.online
gurmou.site
hakena.online
halibut.site
hamadryas.online
haplochromis.online
heliconiinae.online
hepatica.online
herpetodryas.online
herrings.site
hesperiidae.online
heteroptera.online
heterotypus.online
hierodula.online
hippoglossus.online
hkjn.online
hkol.online
hohlomida.site
holodosiz.site
homoptera.online
horivana.site
hpoi.online
hymenoptera.online
id-metrika.site
inachis.online
incursio.online
incursionibus.online
incursus.online
intumescere.online
irritabilitas.online
jaculusan.online
kallima.online
khjs.online
khpf.online
kjoi.online
labefacere.online
labefactare.online
lacerare.online
latesa.online
lepidopteras.online
libellulat.online
libellulidae.online
limenitidinae.online
limenitis.online
limosa.online
limulusa.online
lophacris.online
lovarinda.site
lusciniar.online
lycaenidae.online
mackereli.site
maniola.online
mantidae.online
mantodeas.online
meandrusas.online
megascolias.online
megatos.online
melitaeas.online
merostomata.online
mesant.online
metcalfas.online
morphinaes.online
morphon.online
mortivan.site
mugil.online
mulletin.site
natrixy.online
nematoceras.online
nilesa.site
niloticus.online
noctuidaes.online
nymphalidaes.online
office360-expert.online
orbicularis.online
ovinus.online
panchax.online
papiliot.online
perchi.site
petulans.online
pfkj.online
pilcharda.site
plaices.site
plantora.online
polyphemus.online
pomfreti.online
portunio.site
rainbowt.site
regionem.online
rufescens.online
rumpere.online
sairanat.online
salmoni.site
saltator.online
saury.site
sauryn.online
scolopaxys.online
scorpiones.online
shaperi.online
silvicol.online
sinensisa.online
soled.site
sphaerion.online
sprata.online
sprata.site
spratan.online
stealheada.site
stellarisa.online
strigigena.online
suaveolens.online
sufflari.online
suffundi.online
suffunditur.online
superfluere.online
superfundi.online
superventus.online
testudos.online
tilapian.online
tnoi.online
trouta.site
tunara.online
turgescere.online
ugorado.online
usa-national.info
variare.online
vincula.online
viraglo.site
vitrokaz.site
who-int.info
xiphosura.online


# Cluster 10
desandra.ru
votifa.ru


# Cluster 11 nsfocusglobal[.]com/russian-apt-group-gamaredon-launches-phishing-campaign-against-ukrainian-ministry-of-foreign-affairs/
# Use very different techniques:
# Changes reg[.]ru IPs frequently but all on same /24 and all massively-shared, domain is old (2019) and .fun TLD
# Traced back and confirmed it's linked to old "Cluster 1" infrastructure.

normandia.fun