Gamaredon APT targets Ukrainian government agencies in new campaign
Summary: Cisco Talos observed Gamaredon APT distributing malicious LNK files inside RAR archives via phishing emails carrying Microsoft Office documents with remote-template VBScript macros, in an espionage campaign active as recently as August 2022 and aimed at Ukrainian victims. The chain delivers a new dual-purpose infostealer that exfiltrates files with extensions including .doc, .docx, .xls, .pdf, .ps1, .rar and .zip, captures the user's screen up to nine times, and pulls additional payloads from a command-and-control server that only accepts connections from Ukrainian IP address space.
Why it matters: The implant enumerates removable drives and copies files such as a document from an E: drive into %TEMP% before exfiltration, so data on connected USB media leaves alongside files on the endpoint. Talos assesses the campaign is almost certainly directly targeting entities based in Ukraine, and the C2 servers refusing connections from outside Ukrainian address space narrows who is being hit.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026