Gamaredon Group

Gamaredon is a Russia-aligned cyberespionage threat actor widely assessed as linked to the Russian Federal Security Service (FSB), including reporting that ties it to the FSB’s 18th Center of Information Security. The group is primarily focused on Ukraine and has conducted sustained, large-scale operations against Ukrainian government, military, security, and other critical-sector organizations. Common aliases include Actinium, Armageddon, Aqua Blizzard, Primitive Bear, Shuckworm, Trident Ursa, Iron Tilden, DEV-0157, UAC-0010, UNC530, APT-C-53, SectorC08, and Earth Dahu. Gamaredon is notable for high operational tempo, persistent access operations, and broad spearphishing activity rather than exceptional stealth or technical sophistication. Its campaigns frequently use malicious documents, archive attachments, XHTML and HTML-smuggling lures, and script-heavy infection chains built around obfuscated PowerShell, VBScript, and VBA macros. The group has repeatedly targeted Ukrainian entities with themed lures impersonating official communications and has used downloaders, web-shell-like implants, and follow-on payloads to establish footholds, execute remote commands, and deploy additional malware. The group’s malware ecosystem includes families and components such as GammaPhish, GammaWorm, GammaLoad, GammaSteel, Pterodo, PteroSand, PteroLNK, PteroPaste, PteroSetup, PteroDee, PteroCache, PteroDum, PteroOdd, and PteroEffigy. These tools support initial access, persistence, document theft, in-memory payload execution, lateral movement, and propagation via removable and network drives. Gamaredon has also used commodity or publicly available tooling, including remote administration and reverse-shell frameworks, adapting them for espionage operations. Tradecraft associated with Gamaredon includes spearphishing, malicious macro execution, HTML smuggling, scheduled-task persistence, Startup-folder persistence, Registry Run-key persistence, weakening Microsoft Office macro security settings through registry modification, removable-media discovery, USB-assisted propagation, system information discovery, and document exfiltration. The group has been observed gathering host identifiers and drive information, scanning removable drives, and using weaponized LNK files and installer replacement techniques to spread within targeted environments. A defining feature of Gamaredon’s more recent operations is extensive abuse of legitimate and third-party services to conceal infrastructure and improve resilience. The actor has used cloud storage, dead-drop resolvers, tunneling services, serverless worker platforms, messaging and publishing services, and social-media-like platforms for command-and-control discovery, payload retrieval, and exfiltration. This reliance on legitimate services complicates blocking and takedown efforts and reflects an evolution toward more flexible, layered infrastructure. Gamaredon remained highly active through 2025, when it reportedly conducted dozens of distinct spearphishing campaigns, most in the second half of the year, primarily against Ukrainian governmental and military institutions. Reporting also describes continued malware development, including new PowerShell-based tooling and exploitation of CVE-2025-8088 in some campaigns to gain persistence. The group’s sustained focus on Ukrainian targets, alignment with Russian state interests, and long-running role as an access and espionage actor make it one of the most persistent Russian cyber threats in the Russia-Ukraine conflict.