Skip to content

Gamaredon group expands malware arsenal in ongoing Ukraine cyberattacks

Chimera readability score 82 out of 100, Specialist reading level.

The Hacker News reports that the Russian advanced persistent threat (APT) group Gamaredon has continued to evolve and expand its malware arsenal as part of its ongoing cyber onslaught against Ukraine throughout 2025.ESET reported that Gamaredon conducted 35 distinct spear-phishing campaigns targeting Ukrainian governmental and military institutions in 2025, primarily in the latter half of the year. The group's objective remains the exfiltration of sensitive information to support Russian interests. Attacks utilize archive attachments or XHTML files with HTML smuggling to deliver malicious HTA downloaders, which then drop additional payloads like PteroSand. Some campaigns exploited a now-patched WinRAR flaw (CVE-2025-8088) to place the downloader in the Windows Startup folder for persistence. Gamaredon also employed PteroLNK and PteroPaste for lateral movement via infected USB and network drives, and PteroSetup to replace legitimate installer files with malicious 7z archives.The group increasingly relied on third-party services for tunneling and serverless worker platforms to obscure its back-end infrastructure. Six new PowerShell tools, including PteroDee, PteroCache, PteroDum, PteroOdd, PteroEffigy, and PteroPaste, were introduced, broadening their custom malware capabilities. Gamaredon also leveraged legitimate services like Telegra.ph, Dropbox, and GoFile for data exfiltration and command-and-control communication, making their operations more resilient and difficult to disrupt.The Hacker News
Source: Threat Intelligence
Gamaredon group expands malware arsenal in ongoing Ukraine cyberattacks
Credit: Adobe Stock Images
Related Events
Get daily email updates
SC Media's daily must-read of the most current and pressing daily news
You can skip this ad in 5 seconds

Sentinel — Human

Confidence

This text reads like structured reporting derived from specific security sources, exhibiting high internal consistency consistent with human-edited threat analysis.

Signals Detected
low severity: Moderate sentence length variance; informational flow is direct but not purely metronomic.
low severity: High coherence and logical flow, consistent with standard threat intelligence reporting structure.
low severity: Specific references to sources (ESET, Hacker News) and technical specifics (CVEs, malware names) suggest reliance on external data points.
Human Indicators
The inclusion of specific, recent-sounding details (2025 dates, CVE reference) points toward sourcing from live threat intelligence reporting rather than generic LLM fabrication.
The tone is purely descriptive and objective, lacking the characteristic vagueness or emotional hedging often seen in synthetic content.