Gamaredon
Russia
Tracked by CyberSIXT since 19 Sep 2025
- Articlesall time
- 10
- Articleslast 30 days
- 0
- CVEs exploitedattributed · all time
- 1
- Research reportsall time
- 9
12 articles from 6 outlets since 19 Sep 2025; the latest 119 days ago.
- Article
- Research report
Show as table
Profile
Written by CyberSIXT from the sources listed below. Updated 26 Oct.
Microsoft tracks Gamaredon as Aqua Blizzard and ACTINIUM2. MITRE ATT&CK describes Gamaredon as a suspected Russian cyber espionage group targeting Ukraine since at least 20131. MITRE ATT&CK records the Ukrainian government’s November 2021 attribution to Russia’s Federal Security Service (FSB) Center 181.
Security Affairs reported that Gamaredon exploited WinRAR vulnerability CVE-2025-8088 to deploy modular, fileless malware, using HTML smuggling and NTFS Alternate Data Streams to conceal components3. Infosecurity reported that Gamaredon used GammaWorm in an espionage campaign targeting Ukrainian government and military sectors4. Dark Reading reported that Gamaredon used tunneling services and cloud-based storage to disguise command-and-control operations5.
Sources
- Gamaredon: description · MITRE ATT&CK
- Gamaredon: alias · Microsoft
- Gamaredon Uses WinRAR Vulnerability to Launch Modular Spy Campaign on Ukrainian Targets · Security Affairs · 2026-06-04
- Ukrainian networks hit by stealth Gamaredon worm via WinRAR flaw · Infosecurity · 2026-06-01
- Gamaredon refines cyber espionage using USB malware and cloud · Dark Reading · 2026-06-25
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.
Diamond Model
What the record links to GamaredonRecorded associations sorted by Diamond Model vertex. They do not reconstruct an intrusion or establish a campaign. Model: Caltagirone, Pendergast and Betz (2013).
Names and sources
18 names- Gamaredon
- CyberSIXT coverage, Malpedia, Microsoft
- Gamaredon Group
- CyberSIXT coverage, Malpedia, MISP Galaxy, MITRE ATT&CK®
- ACTINIUM
- Malpedia, Microsoft, MISP Galaxy, MITRE ATT&CK®
- Aqua Blizzard
- Malpedia, Microsoft, MISP Galaxy, MITRE ATT&CK®
- Armageddon
- Malpedia, Microsoft, MITRE ATT&CK®
- Blue Otso
- Malpedia, MISP Galaxy
- BlueAlpha
- Malpedia, MISP Galaxy
- DEV-0157
- Malpedia, MISP Galaxy, MITRE ATT&CK®
10 more names
- G0047
- Malpedia, MISP Galaxy
- IRON TILDEN
- Malpedia, MISP Galaxy, MITRE ATT&CK®
- PRIMITIVE BEAR
- Malpedia, Microsoft, MISP Galaxy, MITRE ATT&CK®
- SectorC08
- Malpedia, Microsoft
- Shuckworm
- Malpedia, Microsoft, MISP Galaxy, MITRE ATT&CK®
- Trident Ursa
- Malpedia, MISP Galaxy
- UAC-0010
- Malpedia, MISP Galaxy
- UNC530
- Malpedia, Microsoft
- Winterflounder
- Malpedia, MISP Galaxy
- NastyShrew
- MITRE ATT&CK®
Attributed facts
- Origin
Russia Microsoft · Aqua Blizzard, MISP Galaxy
- Category
State Microsoft · Aqua Blizzard
- Sectors
Government MISP Galaxy
- Suspected victims
Germany, Ukraine MISP Galaxy
CVEs exploited
1 CVE an article attributes to GamaredonVendors targeted
Malware and tools
MITRE ATT&CK® · G0047 6
MITRE ATT&CK® techniques
70 techniques · 13 tacticsFrom MITRE ATT&CK® · G0047
Resource Development 6
Execution 9
Persistence 4
Privilege Escalation 3
Stealth 17
- T1027
- Obfuscated Files or Information
- T1027.004
- Compile After Delivery
- T1027.010
- Command Obfuscation
- T1027.012
- LNK Icon Smuggling
- T1027.015
- Compression
- T1027.016
- Junk Code Insertion
- T1036.005
- Match Legitimate Resource Name or Location
- T1055
- Process Injection
- T1070.004
- File Deletion
- T1140
- Deobfuscate/Decode Files or Information
- T1218.005
- Mshta
- T1218.011
- Rundll32
- T1221
- Template Injection
- T1480
- Execution Guardrails
- T1497.001
- System Checks
- T1564.003
- Hidden Window
- T1620
- Reflective Code Loading
Discovery 9
Lateral Movement 4
Collection 5
Command and Control 12
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK
- Gamaredon Expands Ukraine Attacks with New Malware and Cloud Service AbuseThe Hacker News
- Gamaredon refines cyber espionage using USB malware and cloudDark Reading
- Russian APTs exploit WinRAR flaw CVE-2025-8088 to target UkraineSecurity Affairs
- Gamaredon Uses WinRAR Vulnerability to Launch Modular Spy Campaign on Ukrainian TargetsSecurity Affairs
- Gamaredon exploits WinRAR bug to drop GammaWorm in UkraineThe Hacker News
- Ukrainian networks hit by stealth Gamaredon worm via WinRAR flawInfosecurity
- Turla’s Kazuar backdoor now powers stealthy peer to peer botnetThe Hacker News
- Secret Blizzard’s Kazuar malware hits govts with P2P botnetMicrosoft
- ESET uncovers Gamaredon–Turla collaboration in Ukraine cyberattacksSecurity Affairs
- Turla and Gamaredon Working Together in Fresh Ukrainian IntrusionsSecurityWeek
- Russian Hacking Groups Gamaredon and Turla Target Organizations to Deliver Kazuar BackdoorGBHackers
- Russian Hackers Gamaredon and Turla Collaborate to Deploy Kazuar Backdoor in UkraineThe Hacker News · first in our coverage
Research reports
- Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliancesESET · 23 Sep
- https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.jsonraw.githubusercontent.com · 8 Jul
- eset-apt-activity-report-q2-2025-q3-2025.pdfESET · 20 Jun
- Malware Spotlight – Into the Trash: Analyzing LitterDrifterCheck Point · 7 May
- Threat Group Cards: A Threat Actor EncyclopediaETDA Threat Group Cards · 6 Apr
- Inside The Lab - HarfangLabHarfangLab · 6 Apr
- BlueAlpha Abuses Cloudflare Tunneling Service for GammaDrop Staging InfrastructureRecorded Future · 28 Dec 2024
- cyberespionage-gamaredon-way.pdfESET · 25 Oct 2024
- Microsoft Word - tale_of_gamaredon_infection.docxria.ee · 17 Sep 2024