Loading story…
EclecticIQ uncovered an automated spear-phishing campaign targeting Ukrainian government entities, including the Foreign Intelligence Service and Security Service of Ukraine. An exposed SMTP server at 194[.]180[.]191[.]56 hosted a web panel used to send spoofed emails with malicious attachments. Analysts linked the February 2023 campaign to Gamaredon, a threat group associated with Russia’s Federal Security Service, through overlaps in tactics, targets, and infrastructure. A misconfigured .htaccess file exposed five infrastructure addresses, including one associated with a historical Gamaredon campaign exploiting Microsoft Office vulnerability CVE-2017-0199; the reference does not establish that this vulnerability was used in the newly observed campaign.
The findings complement reporting on Gamaredon’s network infrastructure and its abuse of Telegram to target Ukrainian organizations, highlighting the group’s use of multiple services to support operations against Ukrainian targets. The exposed panel demonstrates how automated email delivery can support repeated spear-phishing attempts while infrastructure reuse provides opportunities for detection and attribution. EclecticIQ recommended phishing-awareness training, email authentication, timely security updates, and attachment filtering. Defenders should incorporate the disclosed infrastructure into threat hunting and review suspicious attachment activity, while treating historical vulnerability links as investigative context rather than evidence of current exploitation.
Get the infrastructure and lures behind it.
9 events from the most recent confirmed update back to the earliest known activity.
EclecticIQ identified a campaign targeting Ukrainian government entities, including the Foreign Intelligence Service of Ukraine and the Security Service of Ukraine. Its tactics, victimology, and infrastructure overlapped with previously identified Gamaredon activity.
A phishing email sent to a Ukrainian military address used pivn-kr@prokuratura[.]dp[.]ua, the same sender address hardcoded in the exposed web panel. This supported EclecticIQ's assessment that the panel was used for malware delivery.
An observed phishing email dated February 8 was sent from 194[.]180[.]191[.]56 with a RAR archive attachment used to deliver initial malware. Its malware execution flow matched previously documented Gamaredon campaigns.
BlackBerry attributed 109[.]200[.]159[.]54 to Gamaredon. WHOIS records identified its registrant as Michael Tishin, who was also listed for an address found in the subsequently exposed server configuration.
Cisco reported the historical spear-phishing campaign against the Security Service of Ukraine and attributed it to Gamaredon.
The phishing email targeting the Security Service of Ukraine was submitted to VirusTotal. Its X-Sender-IP field contained 109[.]200[.]159[.]59, which later linked the historical campaign to the exposed phishing infrastructure.
A phishing email sent to the Security Service of Ukraine contained a malicious Word attachment and a spoofed sender field. The attachment exploited CVE-2017-0199 to download second-stage malware from erythrocephala[.]online, a domain attributed to Gamaredon.
EclecticIQ discovered a publicly exposed SMTP server at 194[.]180[.]191[.]56 hosting a web panel that automated spoofed phishing emails with malicious attachments. A misconfigured .htaccess file exposed five infrastructure addresses, including 109[.]200[.]159[.]59, linking the server to the November 2020 campaign.
An observed phishing email dated February 15 was sent from 194[.]180[.]191[.]56 with a RAR archive attachment used for initial malware delivery. Its execution flow matched those documented in previous Gamaredon campaigns.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 10 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
blogs.blackberry.com
Open sourceblog.eclecticiq.com
Open sourceblogs.cisco.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Russia-linked **Gamaredon** threat group, also tracked as **ACTINIUM**, **Primitive Bear**, **Shuckworm**, and **Aqua Blizzard**, has been tied to sustained spearphishing operations against Ukrainian government and state institutions. Reporting describes lure documents delivered through spoofed or compromised email accounts, with infection chains using remote template injection, **VBA macros**, and malware components including **GammaDrop**, **GammaLoadIdentifier**, and the custom backdoor **Pteranodon**. Researchers said the activity remained ongoing across multiple waves and was aimed at gaining initial access and maintaining footholds inside targeted environments. Technical analysis linked the campaign to abuse of **`CVE-2025-8088`**, startup-folder **VBScript** persistence, changes to Microsoft Word macro security registry settings, host identifier collection, and HTTP-based command-and-control communications over dynamic DNS-hosted infrastructure. Separate infrastructure research expanded on previously reported Gamaredon/ACTINIUM network assets by using passive DNS pivots, identifying domain and subdomain patterns, shared IP reuse, and additional likely attacker-controlled **`.ru`** domains consistent with the group’s broader operational infrastructure.
Aug 15, 2026
Russia-linked **Gamaredon**—also tracked as **Shuckworm**, **Primitive Bear**, **Trident Ursa**, and **STEADY#URSA**—conducted sustained cyber-espionage operations against Ukrainian government, military, and other public- and private-sector organizations, while also probing at least one petroleum refining company in a NATO member state. Researchers reported a sharp rise in email-borne attacks tied to the group, including a late-2022 surge against `gov.ua` subdomains and broader targeting of energy, media, financial, business, and non-profit entities. The actor increasingly used both Ukrainian- and English-language lures delivered through spearphishing emails, malicious attachments, phishing pages, and archive files to gain initial access and support intelligence collection. Across multiple campaigns, Gamaredon deployed evolving malware chains that included the **Pteranodon** backdoor, the **SUBTLE-PAWS** PowerShell backdoor, and at least eight additional custom payloads, alongside legitimate tools such as **UltraVNC** and **Process Explorer**. Intrusions used macro-enabled Word documents, remote template injection, `.lnk` shortcut files, VBS droppers, scheduled tasks, startup-folder persistence, registry `Run` keys, and repeated HTTP/HTTPS command-and-control callbacks, with some infrastructure hosted through Dynamic DNS, Telegraph pages, DNS-based retrieval, and network space linked to **AS9123 TimeWeb Ltd.** Researchers also observed USB propagation behavior, exploitation attempts for `CVE-2021-3438`, and suspicious `msiexec` activity, underscoring the group’s continued adaptation of tradecraft for long-term access and espionage in support of Russia’s war-related objectives.
Aug 15, 2026
Ukraine’s Security Service (**SSU**) publicly identified five alleged members of the **Gamaredon** cyber-espionage group and said the operators worked from Sevastopol, Crimea, under the direction of Russia’s **FSB Center 18**. The SSU said it issued high-treason notices and released intercepted calls to support its claims, marking a rare public attribution of the group to a named Russian security service. Ukrainian authorities said Gamaredon had operated since 2013 and carried out more than **5,000 cyberattacks** against over **1,500** Ukrainian government systems, focusing on intelligence collection from security, defense, and law-enforcement bodies. Reporting and threat tracking describe Gamaredon—also known as **Armageddon**, **Shuckworm**, **Primitive Bear**, **Trident Ursa**, **ACTINIUM**, **DEV-0586**, and **UAC-0010**—as a long-running Russian espionage actor that primarily targets Ukrainian state entities, with some activity extending to European institutions. The group is known for spearphishing and spoofed emails carrying malicious Office documents, macros, VBScript, PowerShell, and batch files, along with malware such as **Pterodo/Pteranodon**, **GammaLoad**, **GammaDrop**, **GammaSteel**, and **QuietSieve**. Analysts also link the actor to evasive infrastructure including dynamic DNS, fast-flux hosting, dead-drop resolvers, and Telegram- or GitHub-linked delivery and control mechanisms, as well as data theft, screenshot capture, remote access, and destructive actions such as file wiping and desktop defacement.
Aug 15, 2026