Gamaredon Expands Ukraine Attacks with New Malware and Cloud Service Abuse
Summary: ESET observed 35 distinct Gamaredon spear-phishing campaigns against Ukraine in 2025, mostly in the second half of the year, targeting government and military institutions through archive attachments and XHTML files that use HTML smuggling to deliver HTA downloaders such as PteroSand. The group also exploited the now-patched WinRAR flaw CVE-2025-8088 to place a downloader in the Windows Startup folder, added six new PowerShell tools, and increased its use of tunnel services, serverless worker platforms, dead drops, dynamic DNS, and cloud storage to hide its back-end infrastructure.
Why it matters: ESET's researcher notes that updates clustered before Russian and Crimean holidays and stopped during them, suggesting the operators are government-affiliated employees - a state-backed adversary that compensates for simple malware with persistence, frequent updates, and creative abuse of legitimate services, making its operations harder to disrupt.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-8088
- Related
- CVE-2025-8088: RARLAB WinRAR Path Traversal Vulnerability Known Exploited Vulnerabilities · Aug 12, 2025