Gamaredon Intensifies Cyber Attacks on Ukraine with New Malware Tactics

Gamaredon, a Russian advanced persistent threat (APT) group, has significantly intensified its cyber operations against Ukraine throughout 2025. According to ESET, a Slovakian cybersecurity firm, the group has conducted 35 distinct spear-phishing campaigns primarily targeting Ukrainian governmental and military institutions, particularly in the latter half of the year. ESET noted that Gamaredon's main objective remains the exfiltration of sensitive information to support Russian interests amid the ongoing conflict.

The spear-phishing attacks utilize archive attachments and XHTML files that employ HTML smuggling techniques to deliver malicious HTA downloaders. These downloaders are responsible for deploying additional payloads, including a new malware variant named PteroSand. Some campaigns have exploited a patched vulnerability in WinRAR (CVE-2025-8088) to place malicious HTA downloaders into the Windows Startup folder of victims, ensuring automatic execution upon the next login.

Gamaredon's tactics also involve the use of weaponizers like PteroLNK and PteroPaste, which facilitate lateral movement by infecting USB and network drives with malicious LNK files. When these files are opened, they trigger the retrieval of downloader malware. Additionally, the group has employed PteroSetup, an older Visual Basic Script (VBScript) weaponizer, to scan for legitimate installer files on USB and network drives, replacing them with self-extracting archives that contain both the original installer and a malicious downloader.

ESET highlighted a notable increase in Gamaredon's reliance on third-party services in 2025, utilizing tunnel services and serverless platforms to obscure its backend infrastructure. The group introduced six new malicious PowerShell tools, further diversifying its malware arsenal. ESET researcher Zoltán Rusnák indicated that while Gamaredon took a brief operational pause in January 2025, it focused on developing and deploying new tools in the first half of the year, with updates timed around significant Russian and Crimean holidays.

The group has also creatively leveraged legitimate online services for data exfiltration and as dead drop resolvers, enhancing the stealth of its operations. ESET concluded that Gamaredon's persistent updates and innovative use of legitimate services have made its cyber operations increasingly difficult to disrupt, reflecting a continued evolution in its attack strategies.