Gamaredon - When nation states don’t pay all the bills
Summary: Cisco Talos reports that Gamaredon, an APT active since 2013, has built infrastructure of more than 600 domains that have used over 330 IP addresses across 16 countries, with more than 230 of those IPs geolocated to Russia. The group uses Windows Batch and VBS first stages, sometimes delivered through VBA macros in malicious documents, and has targeted a major bank in West Africa, U.S. educational facilities, and European telecommunications and hosting providers.
Bottom line: Talos assesses Gamaredon as a possible second-tier actor that steals information and passes it to top-tier teams, so a breach attributed to this noisy, low-sophistication group may be a supply chain into a more capable adversary. Its 600-plus domains and broad victimology mean the odds an organization lands in its path are higher than the group's amateur reputation suggests.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026