{"id":1499,"date":"2026-06-29T13:07:30","date_gmt":"2026-06-29T13:07:30","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=1499"},"modified":"2026-06-29T13:07:30","modified_gmt":"2026-06-29T13:07:30","slug":"gamaredon-expands-ukraine-attacks-with-new-malware-and-cloud-service-abuse","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=1499","title":{"rendered":"Gamaredon Expands Ukraine Attacks with New Malware and Cloud Service Abuse"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Jun 29, 2026<\/span><\/span>Cloud Security \/ Malware<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

A Russian advanced persistent threat (APT) group has continued to evolve and expand its malware arsenal as part of its ongoing cyber onslaught against Ukraine throughout 2025.<\/p>\n

Slovakian cybersecurity company ESET said it observed 35 distinct spear-phishing campaigns mounted by Gamaredon against new targets, with most of them taking place in the second half of the year. Primary targets of these efforts include Ukrainian governmental and military institutions.<\/p>\n

\u00abThroughout 2025, Gamaredon stayed highly active and remained focused solely on Ukraine,\u00bb ESET said<\/a>. \u00abThe group’s ultimate goal continues to be the exfiltration of sensitive information and other critical data that could be exploited to support Russian interests in the ongoing war in Ukraine.\u00bb<\/p>\n

The spear-phishing campaigns make use of archive attachments or XHTML files that employ HTML smuggling to deliver malicious HTA downloaders that are responsible for dropping additional payloads, such as PteroSand. Some of the attacks have also weaponized a now-patched flaw in WinRAR (CVE-2025-8088) as a way of placing the malicious HTA downloader into the victim’s Windows Startup folder.<\/p>\n

This, in turn, causes the downloader to be automatically executed on the next login, thereby adding a persistence mechanism to the compromise chain. Gamaredon’s attacks are known to rely on weaponizers like PteroLNK and PteroPaste to facilitate lateral movement by infecting USB drives and network drives with malicious LNK files that, when opened by an unsuspecting user, trigger the retrieval of downloader malware.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Also used is PteroSetup, an older Visual Basic Script (VBScript) weaponizer first detected in January 2021 and likely assumed to be discontinued. The tool scans USB and mapped network drives for legitimate installer files, and if found, replaces them with 7z self-extracting (SFX) archives containing the original installer and a malicious VBScript downloader.<\/p>\n

<\/p>\n

\u00abIn 2025, the group’s reliance on third-party services grew significantly, with tunnel services and serverless worker platforms becoming an increasingly important part of how it hid its real back-end infrastructure,\u00bb ESET said.<\/p>\n

\"\"<\/a><\/div>\n

The attacks are also characterized by the introduction of six new malicious PowerShell tools, broadening its custom malware arsenal –<\/p>\n