The Russia-aligned advanced persistent threat (APT) group Gamaredon, also known as UAC-0010, maintained a high operational tempo throughout 2025, primarily targeting governmental and military institutions in Ukraine. The group, which the Security Service of Ukraine (SSU) attributes to the 18th Center of Information Security of Russia's FSB, significantly evolved its tactics, tools, and infrastructure to enhance its cyberespionage capabilities.
Throughout 2025, Gamaredon's ultimate goal remained the exfiltration of sensitive information and critical data to support Russian interests in the ongoing conflict in Ukraine. Researchers observed 35 distinct spearphishing campaigns, with a notable increase in frequency and scale during the second half of the year. These campaigns often utilized archive attachments or XHTML files with HTML smuggling to deliver malicious HTA downloaders, which then fetched additional payloads like the VBScript downloader PteroSand.
A significant shift in the latter part of 2025 involved the abuse of CVE-2025-8088, a WinRAR vulnerability. Starting September 26, 2025, Gamaredon began exploiting this vulnerability to place its HTA downloader into a victim's Startup folder, ensuring execution upon the next login and adding persistence to their compromise chain.
Beyond spearphishing, Gamaredon continued to employ custom weaponizers for lateral movement within or across organizations. These tools were designed to weaponize USB drives, mapped network drives, and even software installers, facilitating broader infiltration after an initial compromise.
The group introduced six new PowerShell tools in 2025, with five appearing in the first quarter, indicating a focus on developing new delivery chains early in the year. These new tools include PteroDee and PteroCache, which are PowerShell downloaders for fetching and executing payloads in memory, and PteroDum, which serves a similar function. The group also resurrected an older VBScript weaponizer named PteroSetup.
Further enhancements were made to existing file stealers, PteroVDoor and PteroPSDoor, which were upgraded to support exfiltration to cloud storage services. Wasabi, Tebi, and Intercolo became primary exfiltration methods for stolen data.
Gamaredon also implemented new strategies to protect its network infrastructure. Command and control (C&C) servers are now hidden behind various third-party services, including tunnels, workers, dynamic DNS (DDNS), and platform as a service (PaaS). Additionally, the group abused legitimate messaging, social media, blogging, and paste services as "dead drops" for resolving C&C servers and distributing payloads.
Notably, early 2025 saw Gamaredon collaborate with Turla, another Russia-aligned threat actor also linked to the FSB. This cooperation highlights a trend of coordinated cyberespionage campaigns among Russia-aligned groups, likely aimed at amplifying their operational impact. In the past, Gamaredon has also collaborated with the threat actor InvisiMole. This pattern of cooperation extends to other Russia-aligned actors, with observations of UAC-0099 conducting initial access operations and subsequently transferring validated targets to Sandworm for follow-up activity.
