# Gamaredon Escalates Ukraine Campaign with New Malware Arsenal and Abused Cloud Services


Russian-backed threat actor Gamaredon has significantly expanded its cyber operations against Ukraine throughout 2025, deploying six new custom malware tools and increasingly abusing legitimate cloud services to hide command-and-control infrastructure, according to research published by ESET. The persistent campaign represents a marked evolution in both sophistication and operational scope, with 35 distinct spear-phishing campaigns targeting Ukrainian governmental and military institutions.


## The Threat


Gamaredon, also tracked as Sharpened Pencil and Armageddon by other security researchers, has maintained a relentless focus on Ukraine as it continues to support Russian military and intelligence objectives. ESET's analysis reveals the group remains exclusively focused on Ukrainian targets, with reconnaissance and data exfiltration serving as primary objectives.


The 2025 campaign is characterized by:


  • 35 documented spear-phishing campaigns with most activity concentrated in the second half of the year
  • Primary targets: Ukrainian government agencies, military institutions, and defense-related organizations
  • Evolution: Introduction of six new custom PowerShell tools, expanding an already sophisticated malware ecosystem
  • Infrastructure obfuscation: Growing reliance on third-party tunnel services and serverless worker platforms to hide real command-and-control backends

    • According to ESET researcher Zoltán Rusnák, "Throughout 2025, Gamaredon stayed highly active and remained focused solely on Ukraine. The group's ultimate goal continues to be the exfiltration of sensitive information and other critical data that could be exploited to support Russian interests in the ongoing war in Ukraine."


    ## Background and Context


    Gamaredon has operated continuously since at least 2015, initially gaining prominence through its campaigns against Ukrainian institutions and NATO-aligned countries. However, the group's activity intensified dramatically following Russia's full-scale invasion of Ukraine in February 2022, at which point the threat actor pivoted to become a primary cyber actor supporting Russian military operations.


    The group is widely believed to be government-affiliated, operating under the direction of Russian intelligence services. This assessment is supported by operational security patterns observed throughout 2025:


  • Tactical breaks aligned with Russian holidays and major government observances
  • No malware updates during or immediately after Russian holidays (New Year, Victory Day, etc.)
  • Coordinated timing with potential military operations and intelligence collection needs
  • Professional-grade operational security and tool development practices

    • Unlike many financially-motivated cybercriminals, Gamaredon operates without regard for financial gain—a strong indicator of state sponsorship prioritizing intelligence collection over profit.


    ## Technical Details: The Malware Arsenal


    ### Traditional Attack Vectors


    Gamaredon's attack chains begin with social engineering, typically delivered via:


  • Archive attachments (ZIP, RAR) containing malicious executables
  • XHTML files employing HTML smuggling techniques to obfuscate payload delivery
  • Macro-enabled documents in Office formats

    • These initial payloads download HTA (HTML Application) downloader malware, which subsequently retrieves additional stages of the attack.


    ### Persistence Mechanisms


    A particularly notable aspect of the 2025 campaign involves weaponization of CVE-2025-8088, a now-patched vulnerability in WinRAR. The flaw allows attackers to place malicious HTA downloaders into the Windows Startup folder, ensuring automatic execution upon the next system login. This persistence technique extends the window for establishing deeper compromise.


    ### The New PowerShell Arsenal


    ESET identified six new custom PowerShell-based tools, representing significant capability expansion:


    | Tool | Function | Deployment Method |

    |------|----------|-------------------|

    | PteroDee | Fetch and execute PowerShell payloads in memory | Direct C2 communication |

    | PteroCache | Fetch and execute PowerShell payloads in memory | Caching mechanism for redundancy |

    | PteroDum | Fetch and execute VBScript payloads in memory | Alternative script execution |

    | PteroOdd | Fetch single PowerShell payload via Telegra.ph API | Dead drop via legitimate service |

    | PteroEffigy | Retrieve C2 server details via GoFile cloud storage | Cloud-based infrastructure resolution |

    | PteroPaste | Weaponize USB drives and download encrypted payloads | Lateral movement and data exfiltration |


    ### Lateral Movement and Persistence


    Gamaredon continues to leverage earlier-developed weaponizer tools for network propagation:


  • PteroLNK: Infects USB and network drives with malicious LNK (shortcut) files that trigger downloader retrieval when opened
  • PteroSetup: A VBScript-based tool originally detected in January 2021, now repurposed to scan drives for legitimate installer files, replacing them with 7z self-extracting archives containing both the original installer and malicious downloader components

    • ## The Cloud Services Abuse Strategy


    Perhaps the most significant operational evolution observed in 2025 is Gamaredon's increasing reliance on legitimate third-party services to obscure actual infrastructure. Rather than maintaining traditional command-and-control servers, the group has shifted toward:


    ### Data Exfiltration Channels

  • Telegra.ph (anonymous publishing platform)
  • Teletype (collaborative note-taking)
  • Rentry.co (pastebin service)
  • Write.as (blogging platform)
  • Dropbox
  • GoFile
  • DEV Community (dev.to)
  • Mastodon (social network)
  • Various nopaste services (Nopaste.net, Paste.ee)
  • Wasabi, Tebi, Intercolo (cloud storage providers)

    • ### C2 Infrastructure Concealment

  • Tunnel services (proxy networks)
  • Serverless worker platforms (AWS Lambda alternatives, Cloudflare Workers-style services)
  • Dead drop resolvers using legitimate APIs

    • This approach creates significant defensive challenges: blocking malicious infrastructure becomes nearly impossible without also disrupting legitimate services millions of users rely on daily.


    ## Implications for Organizations


    ### Immediate Risks

    Organizations in Ukraine, particularly government agencies and military institutions, face an active and imminent threat. However, the targeting scope extends beyond Ukraine:


  • NATO-aligned countries: Potential espionage against defense contractors and government agencies
  • Critical infrastructure operators: Energy, telecommunications, and logistics sectors warrant heightened alert status
  • Diaspora communities: Ukrainian government agencies abroad may face targeting as intelligence collection extends to external operations

    • ### The Defense Dilemma

    Gamaredon's reliance on legitimate cloud services creates an asymmetric defense problem:


  • Detection challenges: Malicious traffic blends with normal user traffic to mainstream platforms
  • Blocking ineffective: Defenders cannot simply blacklist services without impacting legitimate operations
  • Attribution complexity: The group's infrastructure obfuscation makes forensic attribution more difficult

    • ### Supply Chain Considerations

    The weaponization of CVE-2025-8088 and the abuse of software delivery mechanisms suggest Gamaredon maintains an active scanning and patching program. Organizations should assume 0-day-adjacent vulnerabilities may be exploited with minimal delay following public disclosure.


    ## Recommendations


    ### For Ukrainian Government and Military

    1. Heightened email security: Deploy advanced email filtering with machine learning-based phishing detection

    2. USB enforcement: Disable USB ports where operationally feasible; implement device control policies

    3. Segmentation: Isolate critical systems from general-purpose networks

    4. Behavioral monitoring: Deploy EDR solutions with focus on PowerShell and VBScript execution anomalies

    5. Incident response: Establish dedicated response teams trained on APT tradecraft


    ### For NATO and Allied Organizations

    1. Intelligence sharing: Integrate ESET indicators of compromise into security operations centers

    2. Threat hunting: Proactively search for PteroCache, PteroDee, and PteroEffigy indicators in network logs

    3. Third-party audits: Conduct supply chain security audits, particularly for software distribution channels

    4. Government coordination: Align defensive measures with national cyber agencies and CISA advisories


    ### For Cloud Service Providers

    1. Dead drop detection: Implement machine learning models to identify potential C2 beaconing patterns

    2. Abuse reporting: Streamline abuse reporting processes for security researchers

    3. API monitoring: Monitor for suspicious API patterns consistent with automated infrastructure reconnaissance


    ---


    ## HackWire Analysis


    Gamaredon's 2025 evolution represents a textbook case of adversary adaptation to defensive measures. Rather than developing more sophisticated malware—a costly and time-intensive process—the group has doubled down on operational discipline and infrastructure obscuration. The shift toward legitimate cloud services is particularly significant: it transforms the cost-benefit calculus for defenders by making infrastructure disruption nearly impossible without collateral damage to civilian infrastructure.


    What deserves closer attention is the operational pattern analysis suggesting government affiliation. Malware updates clustering around Russian holidays isn't coincidental—it's the signature of an organization with institutional rhythms. This pattern has profound implications: it suggests Gamaredon operators likely operate within a formal command structure, possibly with shift-based operations. For defenders, this means certain time windows (Russian business hours, post-holiday periods) may show reduced activity, creating brief operational opportunities for incident investigation and remediation.


    The 2025 campaigns also reveal tactical coordination with other Russian-aligned groups. The observed collaboration with Turla (evidenced by shared use of Telegra.ph APIs) suggests a coordinated strategic effort rather than independent operations. This coordination likely reflects higher-level Russian intelligence service direction, possibly coordinating separate units toward unified objectives.


    For organizations outside Ukraine and NATO, the lesson is subtler: these techniques travel. The PteroLNK weaponizer, the HTML smuggling delivery methods, and the cloud-service abuse patterns represent TTPs (tactics, techniques, and procedures) that will inevitably be adopted by other threat actors. The timelag between innovation by sophisticated groups and adoption by commodity malware operators typically ranges from 6-18 months. Defenders should assume these techniques will appear in less-targeted campaigns within the coming months.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Malware](https://www.hackwire.news/category/malware) coverage
  • Cross-reference with [Advanced Threats](https://www.hackwire.news/category/advanced-threats) and [Ukraine](https://www.hackwire.news/category/ukraine)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)