Cyberespionage has remained a relentless characteristic of Russia\u2019s conflict in opposition to Ukraine. ESET Analysis has lengthy tracked Gamaredon<\/a>, one of the energetic Russia-aligned superior persistent menace (APT) teams concentrating on Ukraine. The group, attributed by the Safety Service of Ukraine (SSU)<\/a> to the 18th Middle of Data Safety of Russia\u2019s FSB, maintained a excessive operational tempo all through 2025.<\/p>\n In our newest analysis, we analyze Gamaredon\u2019s exercise throughout 2025, together with new instruments added to its arsenal, important shifts in the way it protects its community infrastructure, and its rising use of authentic third-party companies to cover each command and management (C&C) data and stolen information. The complete technical particulars can be found in our newest white paper<\/a>.<\/p>\n Key factors of this blogpost:<\/strong><\/p>\n The white paper is our third in-depth installment describing the techniques, methods, and procedures (TTPs) of this group, which is believed to function out of occupied Crimea. In September 2024, we revealed a white paper protecting Gamaredon actions from 2022 and 2023 \u2013 Cyberespionage the Gamaredon approach: Evaluation of toolset used to spy on Ukraine in 2022 and 2023<\/a> \u2013 and in July 2025, we revealed a white paper protecting Gamaredon actions from 2024 \u2013 Gamaredon in 2024: Cranking out spearphishing campaigns in opposition to Ukraine with an developed toolset<\/a>.<\/p>\n All through 2025, Gamaredon stayed extremely energetic and remained targeted solely on Ukraine. The group\u2019s final objective continues to be the exfiltration of delicate data and different important information that might be exploited to assist Russian pursuits within the ongoing conflict in Ukraine. Gamaredon\u2019s actions seem like carefully aligned with Russia\u2019s geopolitical aims, concentrating on Ukrainian governmental and navy establishments to achieve an intelligence benefit.<\/p>\n Whereas the group took a brief operational break in January 2025, Gamaredon spent a lot of its effort within the first half of the yr growing and deploying new instruments. We describe them within the Six new instruments, largely delivery-focused<\/a> <\/em>part of this blogpost. Whereas we don\u2019t present the precise timestamps for all adjustments launched to the group\u2019s tooling, we noticed that many updates had been made within the lead-up to main holidays in Russia and Crimea. Notably, no updates had been noticed throughout or instantly after these holidays, additional suggesting that Gamaredon operators are in all probability government-affiliated staff.<\/p>\n Notably, we uncovered that in early 2025, Gamaredon collaborated with Turla, one other Russia-aligned menace actor additionally linked to the FSB<\/a>; we documented our findings in our blogpost Gamaredon X Turla collab<\/a>. This cooperation underscores the potential for coordinated cyberespionage campaigns amongst Russia-aligned teams, more likely to amplify their operational affect. Up to now, Gamaredon additionally collaborated <\/a>with a menace actor that we found and named InvisiMole.<\/p>\n Extra broadly, 2025 additionally offered one other instance of cooperation and process sharing amongst Russia-aligned actors: we noticed the Russia-aligned UAC-0099 group conducting preliminary entry operations and subsequently transferring validated targets to Sandworm for follow-up exercise. We documented our findings in ESET APT Exercise Report Q2 2025\u2013Q3 2025<\/a>.<\/p>\n Within the second half of the yr, the group shifted extra towards bigger and extra frequent spearphishing campaigns; throughout 2025, we recognized 35 of those. As in earlier years, most campaigns used archive attachments or XHTML recordsdata using HTML smuggling<\/a> to ship malicious HTA downloaders, which in flip fetched the VBScript downloader PteroSand and extra payloads. We additionally noticed campaigns that in all probability used malicious hyperlinks as an alternative of attachments.<\/p>\n Determine\u00a01 reveals a chart of distinctive samples of HTA downloaders delivered monthly in Gamaredon spearphishing campaigns. Notice that these figures symbolize minimums for spearphishing makes an attempt, as one HTA downloader might goal a number of people, and people may be focused in a number of campaigns throughout the identical month.<\/p>\n What modified most noticeably was the tempo. Gamaredon was rather more energetic within the second half of the yr, when campaigns grew to become each extra frequent and bigger in scale. Late within the yr, the group additionally launched a brand new method \u2013 from September 26th<\/sup>, 2025 onward, it started abusing CVE-2025-8088<\/a>, a WinRAR vulnerability, to put its traditional malicious HTA downloader into the sufferer\u2019s Startup folder. That allowed the downloader to execute on the following login, including persistence to a compromise chain that had beforehand relied extra closely on person interplay.<\/p>\n Past spearphishing, Gamaredon additionally continued utilizing customized weaponizers for lateral motion. These instruments weaponize USB drives, mapped community drives, and even software program installers, serving to the group unfold inside or throughout organizations after the preliminary compromise.<\/p>\n Gamaredon launched six new instruments in 2025, all written in PowerShell. 5 of them appeared within the first quarter of the yr, suggesting that the group spent the early months of 2025 constructing new supply chains earlier than shifting extra consideration to large-scale spearphishing within the second half.<\/p>\n Most of those new instruments are comparatively easy:<\/p>\n The standout among the many new instruments is PteroPaste<\/strong>, which is significantly extra complicated than the others. It combines a downloader, a USB weaponizer, and a runner element used for persistence and orchestration. Early variations of PteroPaste used Rentry<\/a> as an middleman staging level for encrypted payloads. Later variations moved away from that method and as an alternative retrieve an encrypted C&C hostname from Dropbox, decrypt it regionally, after which connect with infrastructure hidden behind tunnel companies. PteroPaste can be one of many instruments concerned within the Gamaredon X Turla<\/a> collaboration that we documented in 2025.<\/p>\n Gamaredon additionally introduced again PteroSetup<\/strong>, an older VBScript weaponizer that had probably been discontinued years earlier. The resurrected model scans fastened, detachable, and community drives for installer-like executable recordsdata and replaces them with malicious self-extracting archives containing each the unique installer and a malicious VBScript downloader. To the sufferer, the file nonetheless seems authentic, however working it launches each the anticipated installer and the malicious code.<\/p>\n General, the brand new additions to Gamaredon\u2019s arsenal match a sample that we’ve seen earlier than \u2013 fairly than investing in extremely subtle malware, the group prefers a bigger variety of easy instruments that may be up to date rapidly and mixed flexibly.<\/p>\n Vital updates to beforehand identified instruments reminiscent of PteroLNK<\/strong>, PteroPSLoad<\/strong>, PteroPSDoor<\/strong>, PteroVDoor<\/strong>, and PteroBox<\/strong> may be discovered within the white paper<\/a>.<\/p>\n Gamaredon continued to refine its methods for safeguarding its community infrastructure and hiding its C&C servers. In 2025, the group\u2019s reliance on third-party companies grew considerably, with tunnel companies and serverless employee platforms turning into an more and more essential a part of the way it hid its actual back-end infrastructure.<\/p>\n Tunnel companies are authentic instruments that enable a system or utility to be uncovered to the web by way of a provider-controlled area, with out revealing the true server straight. Employees serve an analogous function, however go a step additional: as an alternative of merely forwarding visitors, they’re serverless platforms that may run code and course of requests earlier than passing them on. In apply, each assist obscure the underlying infrastructure and make disruption tougher.<\/p>\n By the tip of 2024, Gamaredon was already relying closely on Cloudflare tunnels (trycloudflare.com<\/span>) to hide its infrastructure, and in 2025 it expanded that method additional. In Might, we started seeing the group disguise C&C servers behind Cloudflare employees (employees.dev<\/span>), and in June it added Microsoft\u2019s devtunnels.ms<\/span> and Loophole (loophole.website<\/span>). These companies had been typically used collectively, with one performing as the first communication path and others serving as fallbacks.<\/p>\n In just a few remoted instances, we additionally noticed experiments with different tunnel companies, reminiscent of loca.lt<\/span> and bore.pub<\/span>, however these didn’t seem to turn into a part of the group\u2019s common toolkit.<\/p>\n Gamaredon additionally returned to a way that had as soon as been a hallmark of its operations<\/a>: dynamic DNS (DDNS). After a number of years of relying extra closely on registered domains, the group once more started utilizing No-IP domains<\/a> throughout a number of instruments, particularly in HTA downloaders delivered in spearphishing campaigns. In parallel, we noticed Gamaredon abuse platform-as-a-service choices from Intelligent Cloud<\/a> (cleverapps.io<\/span>) and Supabase<\/a> (supabase.co<\/span>) in a number of campaigns, suggesting that the group remains to be actively searching for low-cost, disposable infrastructure that blends in with authentic visitors.<\/p>\n One of the essential facets of Gamaredon\u2019s 2025 operations was its heavy use of so-called dead-drop companies. The time period comes from conventional espionage \u2013 as an alternative of assembly straight, one operative leaves data in a public or hidden location and one other retrieves it later. On-line, the precept is analogous. Somewhat than embedding the true malicious server straight in malware, operators place that data on a authentic web site or platform, and the malware retrieves it from there. Which means the malware might first contact a public web page on a authentic service, learn a hidden or staged worth from it, and solely then connect with the precise C&C server.<\/p>\n This method offers attackers a number of benefits. It makes their operations extra versatile, as a result of they’ll swap servers rapidly. It additionally complicates blocking, as a result of defenders could also be reluctant to dam authentic and broadly used companies outright.<\/p>\n In 2025, Gamaredon abused quite a few companies on this approach: Telegram channels (through t.me<\/span>; Telegram\u2019s official URL shortener service), posts on the Telegra.ph (telegra.ph<\/span>) and Teletype (teletype.in<\/span>) platforms, rentry.co<\/span>, write.as<\/span>, Dropbox, GoFile<\/a>, social networks DEV Neighborhood (dev.to<\/span>) and Mastodon (mastodon.social<\/span>), lesma (lesma.eu<\/span>), nopaste.internet<\/span>, and Paste.ee (pastee.dev<\/span>). In some instances, these companies had been used to publish up to date C&C data. In others, they had been used to ship payloads or cloud-storage configuration information.<\/p>\n In comparison with 2024, we additionally noticed a shift in how Gamaredon used these useless drops. Somewhat than merely publishing uncooked C&C IP addresses, operators more and more used them to level malware to infrastructure already hidden behind tunnels or employees. In different phrases, the useless drop typically not revealed the true server straight; as an alternative, it pointed to a different intermediate layer.<\/p>\n The opposite main infrastructure shift we noticed was on the data-exfiltration facet. Gamaredon upgraded two of its flagship file stealers, PteroPSDoor and PteroVDoor, to add stolen recordsdata to S3-compatible cloud storage companies \u2013 suppliers that assist the Amazon S3 API<\/a>, permitting the identical instruments and code to work throughout completely different storage distributors. Over the course of the yr, configurations moved from Wasabi<\/a> (wasabisys.com<\/span>) to Tebi<\/a> (tebi.io<\/span>) after which to Intercolo<\/a> (de-fra.i3storage.com<\/span>), which by December had turn into the first exfiltration vacation spot.<\/p>\n On the identical time, PteroBox continued to add recordsdata to Dropbox, and one newer variant used the rclone<\/a> utility to take action.<\/p>\n Importing stolen recordsdata to cloud storage reduces the necessity for Gamaredon to keep up its personal infrastructure for receiving giant quantities of stolen information. It additionally helps malicious visitors mix in with entry to authentic storage suppliers. Basically, Gamaredon more and more makes use of third-party companies not solely to cover the place directions come from, but in addition to cover the place stolen information goes.<\/p>\n Gamaredon continued to focus its cyberespionage exercise solely on Ukraine all through 2025, and nothing in ESET telemetry means that this may change within the close to future.<\/p>\n Whereas the six new instruments launched in 2025 had been, for probably the most half, easy downloaders, the extra essential improvement was the continued evolution of the infrastructure supporting the group\u2019s operations. Gamaredon additional expanded its use of useless drops, tunnels, employees, dynamic DNS, and cloud storage, making its operations extra versatile and tougher to disrupt.<\/p>\n As in earlier years, the group compensated for the relative simplicity of its malware with persistence, frequent updates, and an more and more inventive abuse of authentic on-line companies. So long as Russia\u2019s conflict in opposition to Ukraine continues, we count on Gamaredon to stay a major cyberespionage menace to Ukrainian establishments.<\/p>\n A complete listing of indicators of compromise (IoCs) may be present in our GitHub repository<\/a> and the Gamaredon white paper<\/a>.<\/p>\n\n
\n
Continued information exfiltration and a brand new alliance<\/h2>\n
New tooling and cooperation within the first half of the yr<\/h3>\n
Bigger and extra frequent spearphishing campaigns within the second half<\/h3>\n
![\"Figure](\"https:\/\/web-assets.esetstatic.com\/wls\/2026\/06-26\/figure-1-1.png\" "\\"Figure")
Weaponizers for motion past the compromised system<\/h3>\n
Six new instruments, largely delivery-focused<\/h2>\n
\n
Superior community infrastructure<\/h2>\n
Tunnels, employees, and a return to DDNS<\/h3>\n
Leveraging an outdated espionage idea: Lifeless drops<\/h3>\n
Cloud storage grew to become the popular exfiltration channel<\/h3>\n
Conclusion<\/h2>\n
IoCs<\/h2>\n
![\"\"](\"https:\/\/web-assets.esetstatic.com\/wls\/eti-eset-threat-intelligence.png\")
<\/a><\/p>\n<\/div>\n\n","protected":false},"excerpt":{"rendered":"