Russia’s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine
Summary: Unit 42 mapped over 500 new domains and 200 samples used by Trident Ursa, the APT attributed by Ukraine's Security Service to Russia's FSB, across the past 10 months of phishing and malware operations. The group extended beyond Ukrainian-language lures to English-language samples and made an unsuccessful attempt on Aug. 30 to compromise a large petroleum refining company in a NATO member nation.
What's compelling: Trident Ursa seeds its fast flux DNS with junk IPs, including one assigned to the U.S. Department of Defense Network Information Center, and pulls command-and-control addresses from Telegram posts, so domain blocklists and DNS logging alone will not reliably expose its real infrastructure.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026