Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances
Summary: ESET Research reports that Gamaredon, the Russia-aligned APT attributed by Ukraine's SSU to the FSB's 18th Center of Information Security, stayed highly active against Ukraine throughout 2025, running 35 spearphishing campaigns and adding six new PowerShell tools, five of which appeared in the first quarter. The group hid command-and-control behind Cloudflare tunnels and workers, Microsoft devtunnels.ms and Loophole, used dead-drop services including Telegram, Telegra.ph, Dropbox and Rentry, and moved exfiltration to S3-compatible storage from Wasabi to Tebi to Intercolo, while from September 26, 2025 it abused the WinRAR vulnerability CVE-2025-8088 to place an HTA downloader in the Startup folder.
What you should know: Gamaredon's dead drops now point to infrastructure already behind tunnels and workers rather than to raw IP addresses, so blocking the legitimate services it abuses means blocking Telegram, Dropbox and Cloudflare - a trade-off most defenders will hesitate to make.
Read the original at ESET WeLiveSecurity ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026