#ESETresearch has published a technical analysis of new malicious tools and major infrastructure changes observed in 2025 in the arsenal of the Russia-aligned #Gamaredon #APTgroup targeting Ukraine 🇺🇦. Blogpost: https://www.welivesecurity.com/en/eset-research/gamaredon-2025-leveraging-tunnels-workers-dead-drops-new-alliances
In 2025, #Gamaredon exclusively targeted Ukrainian governmental and military institutions. We observed 35 distinct #spearphishing campaigns, with activity significantly increasing in the second half of the year, as shown in the graph.
Gamaredon developed six new PowerShell tools in 2025: #PteroDee, #PteroDum, #PteroPaste, #PteroOdd, #PteroEffigy, and #PteroCache. It also resurrected the old #PteroSetup weaponizer. Most of the tools are simple downloaders built for fast deployment and flexible chaining.
#PteroPaste stands out; it combines a downloader, a USB weaponizer, and (for persistence) a runner. Early versions used rentry.co as a dead drop for encrypted payloads; later ones retrieved an encrypted C&C hostname from Dropbox and connected via tunnel services.
In 2025, #Gamaredon significantly expanded how it hides its network infrastructure. Besides #Cloudflare tunnels, it started using Cloudflare workers, Microsoft devtunnels, and Loophole, often combining several of these services as primary and fallback communication paths.
Gamaredon also heavily abused legitimate online services as dead drops for resolving C&C servers and distributing payloads, including t.me, telegra.ph, teletype.in, rentry.co, write.as, gofile.io, dev.to, mastodon.social, lesma.eu, nopaste.net, and pastee.dev. It also returned to No-IP #DDNS and abused PaaS services such as Clever Cloud and Supabase.
Our full technical analysis of #Gamaredon’s 2025 tools, infrastructure, and TTPs is available in the white paper: https://web-assets.esetstatic.com/wls/en/papers/white-papers/gamaredon-in-2025.pdf
IoCs are included in the white paper and also in our GitHub repo: https://github.com/eset/malware-ioc/tree/master/gamaredon

#ESETresearch has conducted a comprehensive technical analysis of new malicious tools and significant updates observed in 2024 in the arsenal of the Russia-aligned #Gamaredon #APTgroup targeting Ukraine🇺🇦. https://www.welivesecurity.com/en/eset-research/gamaredon-2024-cranking-out-spearphishing-campaigns-ukraine-evolved-toolset/
In 2024, #Gamaredon returned to exclusively targeting Ukrainian governmental institutions, significantly increasing the size and frequency of its #spearphishing campaigns compared to previous years, as shown in the chart.
Besides spearphishing, #Gamaredon continues to use custom malware for lateral movement, weaponizing USB and now also network drives via updated versions of PteroLNK. Additionally, the new tool PteroTickle weaponizes Python apps converted to executables.
The VBScript version of PteroLNK has become the group’s most frequently updated tool. It now weaponizes network drives, hides targeted folders, and creates malicious LNK files using JavaScript executed by mshta.exe.
Gamaredon added stealthier methods to known tools. For example, PteroPSDoor now uses WMI event subscriptions and FileSystemWatcher to quietly monitor files, reducing noisy operations that could alert defenders.
The new tool PteroGraphin implements uncommon persistence via Excel add-ins, creating a hidden channel for payload delivery through Telegraph. Later, Gamaredon simplified its persistence, relying instead on scheduled tasks alone.
Another notable addition is PteroBox, a new PowerShell-based file stealer that exfiltrates files to Dropbox. It prioritizes sensitive documents, tracks exfiltrated files via MD5 hashes, and monitors USB insertions through WMI events
In 2024, Gamaredon went to great lengths to bypass network-based blocking. It increasingly hid its C&C servers behind Cloudflare tunnels and leveraged third-party DNS services, Codeberg repositories, and Telegraph posts to evade detection.
Our detailed technical analysis of the latest Gamaredon tools and techniques is available in the white paper: https://web-assets.esetstatic.com/wls/en/papers/white-papers/gamaredon-in-2024.pdf
IoCs are provided in the white paper and at https://github.com/eset/

⚠️ Windows MSHTML zero-day vulnerability under active attack! 🔓 Hackers can exploit this flaw via malicious documents. Apply mitigations ASAP! #Windows #APTGroup #ZeroDay https://www.netsec.news/windows-mshtml-platform-zero-day-vulnerability-actively-exploited-by-apt-group/

Serious Exchange Flaw Still Plagues 350K Servers - The Microsoft Exchange vulnerability was patched in February and has been targeted by several thre... more: https://threatpost.com/serious-exchange-flaw-still-plagues-350k-servers/154548/ #advancedpersistentthreat #microsoftexchange #vulnerabilities #microsoftpatch #microsoftflaw #patchtuesday #microsoft #aptgroup #hacks #patch #apt

Microsoft Exchange Server Flaw Exploited in APT Attacks - A vulnerability is Microsoft Exchange servers is being actively exploited by multiple APT groups, ... more: https://threatpost.com/microsoft-exchange-server-flaw-exploited-in-apt-attacks/153527/ #advancedpersistentthreat #microsoftexchange #microsoftpatch #microsoftflaw #patchtuesday #microsoft #aptgroup #hacks #patch #apt