The Invisible Macro: Defeating Gamaredon’s Remote Template Injection and COM Hijacking

Figure 1: The Gamaredon APT execution chain. The payload utilises OpenXML compression evasion, Remote Template Injection, and COM automation to launder malicious network requests through an invisible Internet Explorer process.

Malware analysis is rarely a straight line from detonation to detection. We build isolated labs, set up our sinkholes, and write our signatures, expecting the malware to behave exactly as the textbooks describe. But advanced threat actors don’t read our textbooks.

Recently, I pulled down a suspected malicious document from a threat feed, fully expecting to spend an hour deobfuscating some messy VBA macros. Instead, I found myself in a high-friction battle against laboratory networking quirks, file structure manipulation, and deep Windows operating system evasion tactics.

This is the story of hunting a Gamaredon APT payload, where the absence of a macro was the loudest alarm of all.

The Missing Engine

The investigation began in my standard air-gapped environment: a REMnux analysis gateway and a Windows 10 victim host. I dropped the sample, masquerading as a legacy .doc file, onto the Windows desktop. With Sysmon, Wireshark, and Process Explorer armed, I double-clicked the file.

Nothing happened. Or rather, a standard Windows prompt appeared asking me how I wanted to open the file. I had hit my first environmental roadblock: my victim VM did not have Microsoft Office installed. Without winword.exe to interpret the visual basic code, the document was effectively a harmless brick.

Instead of pausing to install a multi-gigabyte Office suite, I decided to pivot immediately to static analysis on my REMnux machine. I spun up a quick Python web server on the Windows host (python -m http.server 8000) to transfer the file across the virtual network to REMnux. I ran a standard wget command, pulled the file, and fired olevba at it to rip out the macros.

The Silent Blueprint

After I ran olevba, I was expecting to see heavily obfuscated Visual Basic code. The tool completed its scan and returned a chilling result: No VBA or XLM macros found.

Figure 2: olevba output indicating an absence of native macros.

When dealing with Advanced Persistent Threats (APTs), a completely clean document is highly suspicious. I suspected the threat actor was using Remote Template Injection. Instead of embedding the macro directly into the file where an antivirus can easily spot it, the attacker hides an external URL in the document’s metadata. When Word opens the file, it reaches out to the internet, downloads a macro-enabled template into memory, and executes it silently.

To prove this, I used oleobj to parse the underlying OLE relationships. The output was a brilliant piece of tradecraft. The actor had flooded the document with dozens of legitimate decoy hyperlinks pointing to Ukrainian regional news sites and Facebook groups to blind automated sandbox scanners. But buried at the very bottom of the relationship tree was the smoking gun: an attachedTemplate linking out to **http://prick.falcon62.freebsdo.ru/DESKTOP-6NRN62F/glimpse/council/glimpse/nay.p3l.**

Figure 3: Unmasking the Remote Template Injection mechanism hidden among dozens of decoy Ukrainian social media links.

The Evasion Proxy: COM Hijacking

Having extracted the network indicator statically, I needed to see exactly how this execution looked on a live host. By reviewing sandbox process telemetry for this specific file hash, I uncovered a highly sophisticated endpoint evasion technique.

When a standard maldoc detonates, you usually see winword.exe spawning a noisy scripting engine like cmd.exe or powershell.exe. But this Gamaredon payload utilised Component Object Model (COM) automation. The process tree showed WINWORD.EXE passing the /Automation -Embedding flags to stand up a hidden background instance.

Figure 4: The sandbox process tree exposing the COM automation pivot, where Word silently launches an invisible Internet Explorer session.

This background instance didn’t execute the download itself. Instead, it spawned iexplore.exe (Internet Explorer) with an -Embedding flag, forcing the browser to run completely invisibly. It was the invisible IE process that actually reached out to the .ru infrastructure to download the .p3l template. If an enterprise defender were only looking at network logs, they wouldn’t see Microsoft Word acting maliciously, they would just see normal web browsing traffic from Internet Explorer.

The Final Hurdle: Defeating the Disk

With the network mechanism understood, I wrote a custom YARA rule to catch the malicious attachedTemplate and .ru string sitting dormant on the disk. I ran the scanner against the payload on my Windows machine.

Zero hits.

I knew the string was in there, so why did YARA fail? I realised I had fallen for one of the oldest file-extension tricks. The file was named Gamaredon.doc, implying a legacy binary format. But under the hood, it was actually a modern OpenXML document (.docx), which is literally just a ZIP archive of XML files. YARA was scanning compressed binary gibberish. The strings were heavily zipped.

To defeat this, I manually extracted the .doc file into a folder, exposing the raw XML components. I ran YARA again, this time adding the -r flag for a recursive scan.

Figure 5: The YARA rule successfully triggers on the extracted settings.xml.rels file, defeating the OpenXML compression wrapper.

The terminal instantly lit up. YARA bypassed the compression evasion and successfully flagged the settings.xml.rels file, exactly where Microsoft Word stores its external template blueprints. The hunt was complete.

Key Takeaways and Lessons Learned

Trust Nothing, Verify Everything: File extensions are merely suggestions. The fact that an OpenXML .docx was masquerading as a .doc completely broke my initial YARA scans until I recognised the compression wrapper.

The Network is the Great Equaliser: While the malware successfully used COM hijacking to mask its execution behind an invisible Internet Explorer process on the host, it still required a cleartext HTTP request to fetch the external .p3l template. Perimeter monitoring and active network threat hunting remain critical for uncovering endpoint-evasive initial access vectors.

Technical Resources

Detection Engineering: View the custom YARA rule here

IoC Publication: Access the full list of IoCs on AlienVault OTX

Technical Incident Report: Gamaredon APT Remote Template Injection & COM Hijacking

· Report ID: 2026–06–13-GAM-01

· Classification: TLP:CLEAR

· Subject: Structural Evasion, Remote Template Injection, and COM Browser Hijacking by Gamaredon APT

Executive Summary

A technical analysis was performed on a malicious OpenXML document disguised as a legacy .doc file, attributed to the Gamaredon APT group (UAC-0010). The sample utilises Remote Template Injection to completely avoid embedding malicious VBA macros locally, successfully bypassing standard static signature engines. Upon execution, the payload leverages COM automation to spawn a hidden Internet Explorer instance (iexplore.exe -Embedding), which acts as an execution proxy to fetch a heavily obfuscated macro template (.p3l) from remote attacker-controlled infrastructure.

List of Affected Entities

· Internal Source (Assigned): 192.168.134.10 (Windows 10 Lab Workstation / Hostname: Analyst). Note: The threat actor’s infrastructure URI path dynamically tracks targeted hostnames, identified in this campaign as DESKTOP-6NRN62F.

· Target Identity: Regional public councils, administrative departments, and localised user groups situated in eastern Ukraine (specifically targeting regions including Luhansk, Severodonetsk, and Lysychansk).

· Attacker IP: Domain not actively resolving during time of analysis (Fast-Flux infrastructure).

· Identity: Gamaredon APT (Also tracked as Armageddon, ACTINIUM, Primitive Bear, or UAC-0010).

· VPN Gateway: The threat actor utilises fast-flux dynamic subdomains registered under third-party infrastructure providers to mask primary routing and bypass perimeter geofencing.

· External Actor: State-sponsored cyber espionage operations focusing on persistent tracking, initial access, and subsequent data exfiltration within target networks.

Technical Findings & Analysis Steps

1. Anti-Analysis and Decoy Mechanisms

The document’s internal OpenXML relationship tables (document.xml.rels) are heavily saturated with benign hyperlinks pointing to regional Ukrainian news portals (ostro.org, cxid.info) and localised social media hubs. This structural layout serves to flood automated sandbox network logs with trusted regional traffic, establishing context validity and masking the single malicious outbound request.

2. The Remote Injection Mechanism

Because the document contains no embedded macros, standard endpoint detection rules inspecting files on disk evaluate the file as benign. Execution progresses through the following hidden phases:

· File Read: The local document is launched, unzipping the OpenXML structure into memory.

· Relationship Trigger: Word reads the word_rels\settings.xml.rels file and identifies an attachedTemplate property.

· Cleartext Callout: An HTTP GET request is triggered to fetch the macro-enabled template nay.p3l from prick.falcon62.freebsdo.ru.

Figure 6: Global OSINT correlation confirming the local sandbox telemetry callout to the external fast-flux infrastructure.

3. Endpoint Execution Telemetry (COM Hijacking)

To bypass endpoint network monitoring that flags Microsoft Office applications reaching out to unapproved domains, the payload utilises a dual-stage Component Object Model (COM) hijacking sequence.

· PID 2664 (WINWORD.EXE): The initial weaponised document is launched by the user.

· PID 6248 (WINWORD.EXE): The macro instructions trigger a secondary instance utilising the /Automation -Embedding flags, standing up a hidden background instance of Word.

· PID 7096 & 3348 (iexplore.exe): The hidden Word instance utilises COM to spawn Internet Explorer with the -Embedding flag. This renders the browser completely invisible to the user. The child IE process (PID 3348) executes the actual network request to the .ru domain, effectively laundering the malicious traffic through a trusted web browsing application.