Loading story…
The Russia-linked Gamaredon threat group, also tracked as ACTINIUM, Primitive Bear, Shuckworm, and Aqua Blizzard, has been tied to sustained spearphishing operations against Ukrainian government and state institutions. Reporting describes lure documents delivered through spoofed or compromised email accounts, with infection chains using remote template injection, VBA macros, and malware components including GammaDrop, GammaLoadIdentifier, and the custom backdoor Pteranodon. Researchers said the activity remained ongoing across multiple waves and was aimed at gaining initial access and maintaining footholds inside targeted environments.
Technical analysis linked the campaign to abuse of CVE-2025-8088, startup-folder VBScript persistence, changes to Microsoft Word macro security registry settings, host identifier collection, and HTTP-based command-and-control communications over dynamic DNS-hosted infrastructure. Separate infrastructure research expanded on previously reported Gamaredon/ACTINIUM network assets by using passive DNS pivots, identifying domain and subdomain patterns, shared IP reuse, and additional likely attacker-controlled .ru domains consistent with the group’s broader operational infrastructure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
HarfangLab said the Gamaredon spearphishing campaign targeting Ukrainian state institutions dated back to September 2025. The activity involved spoofed or compromised-email delivery and the GammaDrop and GammaLoadIdentifier infection chain.
Embee Research noted that many domains from Microsoft's ACTINIUM reporting resolved to IP address 139.180.174[.]234 on 2022-07-27. This shared resolution became the basis for later passive DNS pivoting.
Elastic documented a spearphishing email dated January 17, 2020 that targeted the National Security and Defense Council of Ukraine. The lure impersonated official Ukrainian government correspondence and used remote template injection.
Metadata cited by Elastic showed the malicious remote template was created on December 12, 2019 and modified on December 24, 2019. The template was later reused across multiple phishing campaigns.
Elastic said the first sample leveraging the identified Gamaredon domain was submitted to VirusTotal in early September 2019. This provides an early public artifact tied to the campaign infrastructure.
Elastic Security reported that the earliest identified infrastructure associated with the Gamaredon campaign dated to August 2019. This marks the earliest explicit anchor for the activity described in the references.
HarfangLab investigated an active Gamaredon spearphishing campaign and linked it to abuse of CVE-2025-8088. The report identified roughly a dozen phishing waves against Ukrainian state institutions and said the campaign was still ongoing at the time of reporting.
Embee Research published an analysis expanding Microsoft's 2022 ACTINIUM infrastructure reporting by pivoting on passive DNS data. The method produced 159 unique .ru domains and suggested 122 additional candidate domains likely related to the actor, though some may be false positives.
Elastic Security described an ongoing campaign attributed with moderate confidence to Gamaredon that targeted Ukrainian government officials and departments. The report detailed spearphishing, remote template injection, VBA macros, VBScript persistence, and links to updated Pteranodon-related artifacts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
harfanglab.io
Open sourceharfanglab.io
Open sourceharfanglab.io
Open sourceembee-research.ghost.io
Open sourceelastic.co
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Russia-linked **Gamaredon**—also tracked as **Shuckworm**, **Primitive Bear**, **Trident Ursa**, and **STEADY#URSA**—conducted sustained cyber-espionage operations against Ukrainian government, military, and other public- and private-sector organizations, while also probing at least one petroleum refining company in a NATO member state. Researchers reported a sharp rise in email-borne attacks tied to the group, including a late-2022 surge against `gov.ua` subdomains and broader targeting of energy, media, financial, business, and non-profit entities. The actor increasingly used both Ukrainian- and English-language lures delivered through spearphishing emails, malicious attachments, phishing pages, and archive files to gain initial access and support intelligence collection. Across multiple campaigns, Gamaredon deployed evolving malware chains that included the **Pteranodon** backdoor, the **SUBTLE-PAWS** PowerShell backdoor, and at least eight additional custom payloads, alongside legitimate tools such as **UltraVNC** and **Process Explorer**. Intrusions used macro-enabled Word documents, remote template injection, `.lnk` shortcut files, VBS droppers, scheduled tasks, startup-folder persistence, registry `Run` keys, and repeated HTTP/HTTPS command-and-control callbacks, with some infrastructure hosted through Dynamic DNS, Telegraph pages, DNS-based retrieval, and network space linked to **AS9123 TimeWeb Ltd.** Researchers also observed USB propagation behavior, exploitation attempts for `CVE-2021-3438`, and suspicious `msiexec` activity, underscoring the group’s continued adaptation of tradecraft for long-term access and espionage in support of Russia’s war-related objectives.
Aug 15, 2026
Researchers attributed a January 2026 cyberespionage campaign against Ukrainian government, military, and critical infrastructure organizations to the Russia-linked Gamaredon group, which used booby-trapped spearphishing attachments and malicious RAR archives exploiting WinRAR path traversal flaw **`CVE-2025-8088`** for initial access. The infection chain dropped an HTA payload dubbed **GammaPhish**, which launched via `mshta.exe` and fetched follow-on VBScript components including **GammaLoad**, **GammaWorm**, and **GammaSteel**. Sekoia said the operation marks a shift from Gamaredon’s older Pteranodon tooling to a fragmented, modular ecosystem in which multiple stages can independently act as backdoors and retrieve arbitrary remote code. The malware emphasized stealth, persistence, and resilient command-and-control. **GammaWorm** established persistence through scheduled tasks and RunOnce registry keys, hid modules in **NTFS Alternate Data Streams**, and spread through USB devices and network shares using malicious LNK shortcuts, including into air-gapped environments. Command-and-control discovery relied on dead-drop resolvers hosted on **Telegram**, **Telegra.ph**, **graph.org**, **Teletype**, **Cloudflare Workers**, and operator infrastructure, while **GammaSteel** staged dozens of DPAPI-encrypted modules in the registry and exfiltrated selected files to **AWS S3** or other S3-compatible storage with fallback to attacker-controlled servers. Because fresh payloads can be fetched at multiple stages, researchers warned that confirmed compromises may require full system wiping.
Jun 29, 2026
Ukraine’s Security Service (**SSU**) publicly identified five alleged members of the **Gamaredon** cyber-espionage group and said the operators worked from Sevastopol, Crimea, under the direction of Russia’s **FSB Center 18**. The SSU said it issued high-treason notices and released intercepted calls to support its claims, marking a rare public attribution of the group to a named Russian security service. Ukrainian authorities said Gamaredon had operated since 2013 and carried out more than **5,000 cyberattacks** against over **1,500** Ukrainian government systems, focusing on intelligence collection from security, defense, and law-enforcement bodies. Reporting and threat tracking describe Gamaredon—also known as **Armageddon**, **Shuckworm**, **Primitive Bear**, **Trident Ursa**, **ACTINIUM**, **DEV-0586**, and **UAC-0010**—as a long-running Russian espionage actor that primarily targets Ukrainian state entities, with some activity extending to European institutions. The group is known for spearphishing and spoofed emails carrying malicious Office documents, macros, VBScript, PowerShell, and batch files, along with malware such as **Pterodo/Pteranodon**, **GammaLoad**, **GammaDrop**, **GammaSteel**, and **QuietSieve**. Analysts also link the actor to evasive infrastructure including dynamic DNS, fast-flux hosting, dead-drop resolvers, and Telegram- or GitHub-linked delivery and control mechanisms, as well as data theft, screenshot capture, remote access, and destructive actions such as file wiping and desktop defacement.
Aug 15, 2026