ETDA สำนักงานพัฒนาธุรกรรมทางอิเล็กทรอนิกส์
Electronic Transactions Development Agency
Home > List all groups > Operation Domino, Operation Kremlin

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link APT group: Operation Domino, Operation Kremlin

NamesOperation Domino (Hunting Shadow Lab)
Operation Kremlin (Clearsky)
CountryRussia Russia
MotivationInformation theft and espionage
First seen2019
Description(Clearsky) ClearSky researchers identified a malicious “.docx” file that was uploaded to VirusTotal from Russia in mid-December. The file contains an obfuscated URL to a remote template which contains malicious VBA, eventually leading to the execution of VBS on the infected machine. The attack’s purpose is to stealthily exfiltrate information without running any external executables on the system.

Notably, the process is escalated on a certain day of the week, suggesting a possible familiarity with the intended victim or victims.

We estimate with medium confidence that the same threat actor responsible for the attacks described in this paper also conducted an attack named “Operation Domino” that occurred earlier in 2020.

We decided to name the operation “Kremlin” due to the use of a parameter named “kreml” in the “poslai” (meaning send in Russian) function that exfiltrates the data.
ObservedCountries: Belarus.
Tools used
Operations performedSep 2020Operation “Domino”
Dec 2020Operation “Kremlin”

Last change to this card: 20 January 2021

Download this actor card in PDF or JSON format

Previous: Operation Comando
Next: Operation Dragon Castling

Digital Service Security Center
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1227
E-mail [email protected]