Actor Profile

Gamaredon (also tracked as Armageddon, Shuckworm, Primitive Bear, and UAC-0010) is a Russian state-sponsored APT group attributed by multiple vendors to Russia's Federal Security Service (FSB). Active since at least 2013, the group has maintained persistent focus on Ukrainian targets, conducting high-volume espionage operations. Gamaredon is characterized by rapid operational tempo, frequent tool iteration, and reliance on commodity malware customized for specific campaigns. The group's motivation centers on intelligence collection supporting Russian strategic interests in Ukraine, particularly since the 2014 annexation of Crimea and escalating through the 2022 full-scale invasion.

TTPs (Tactics, Techniques, Procedures)

Gamaredon employs spear-phishing as its primary initial access vector (T1566), delivering malicious attachments or links to targeted Ukrainian entities. The group is known for abusing legitimate cloud services for command-and-control infrastructure (T1102) and data exfiltration, reducing detection risk and operational costs. Their evolving malware arsenal suggests continuous development and deployment of custom tools (T1587.001), with frequent updates to evade detection. The group demonstrates persistence through high-volume campaigns rather than sophisticated OPSEC, often conducting dozens of parallel operations. Additional likely techniques include user execution via malicious files (T1204), credential harvesting, and lateral movement within compromised networks, though specific MITRE ATT&CK techniques for the 2025 campaigns were not detailed in the provided data.

Targets & Patterns

Gamaredon maintains exclusive focus on Ukrainian targets, reflecting its role as a strategic intelligence collection asset for Russian operations. The 35 distinct campaigns in 2025 indicate targeting of new victim sets, suggesting either expansion beyond previously compromised entities or re-engagement following remediation efforts. Historically, the group has targeted Ukrainian government agencies, military personnel, law enforcement, critical infrastructure operators, and NGOs. The geographic scope mentions Russia, Ukraine, and Slovakia, potentially indicating C2 infrastructure locations or limited targeting beyond Ukraine. The sustained campaign volume (35 distinct operations) demonstrates Gamaredon's resource availability and prioritization of Ukrainian intelligence collection as a persistent operational requirement.

Historical Context

Gamaredon has been one of the most prolific APT groups targeting Ukraine since 2013, with activity intensifying following Russia's 2014 annexation of Crimea. The group's operations surged dramatically after Russia's February 2022 full-scale invasion of Ukraine, with multiple security vendors documenting increased campaign frequency and expanded targeting. ESET has tracked Gamaredon extensively over multiple years, providing longitudinal visibility into the group's evolution. The 2025 campaigns represent a continuation of established patterns: high-volume spear-phishing, cloud service abuse, and continuous malware development. Unlike more sophisticated Russian APT groups (APT28, APT29), Gamaredon prioritizes operational volume and speed over stealth, accepting higher detection rates in exchange for broader intelligence collection. The expansion to 35 new campaigns in 2025 suggests undiminished operational tempo despite years of public exposure and defensive efforts.

Defensive Recommendations

  • Implement robust email security controls with sandboxing and attachment analysis to detect spear-phishing attempts (T1566), particularly scrutinizing documents with macros or embedded links targeting Ukrainian entities
  • Monitor and restrict access to cloud storage services commonly abused by Gamaredon for C2 (T1102), including implementing egress filtering and anomaly detection for unusual data transfers to cloud platforms
  • Deploy endpoint detection and response (EDR) solutions with behavioral analytics to identify Gamaredon's evolving malware variants, focusing on execution patterns rather than static signatures given the group's rapid tool iteration
  • Conduct targeted security awareness training for Ukrainian organizations emphasizing Gamaredon's spear-phishing tactics, including recognition of socially-engineered lures related to current geopolitical events
  • Establish threat intelligence sharing mechanisms to rapidly disseminate Gamaredon indicators of compromise (IOCs) across Ukrainian critical infrastructure and government sectors, leveraging ESET and other vendor reporting

---

# Geopolitical Context

Geopolitical Context

Gamaredon, a threat actor widely attributed to Russia's Federal Security Service (FSB), has intensified cyber operations against Ukrainian targets in 2025, consistent with sustained intelligence collection efforts amid the ongoing conflict. The group's expansion of spear-phishing campaigns—35 distinct operations targeting new victims—reflects a persistent focus on Ukrainian government, military, and civil society entities. The evolution of its malware toolkit and continued abuse of cloud infrastructure demonstrates tactical adaptation to maintain operational effectiveness despite increased defensive measures. This activity aligns with broader Russian strategic objectives to maintain intelligence access and situational awareness in Ukraine, while the mention of Slovakia may indicate either targeting of Ukrainian diaspora, regional intelligence collection, or logistical infrastructure abuse.

State Actor Alignment

Gamaredon is widely attributed by Western cybersecurity firms and government agencies to Russia's Federal Security Service (FSB). The group has been publicly linked to Russian state interests by the Security Service of Ukraine (SBU), the U.S. Cyber Command, and multiple NATO member intelligence services. The actor's targeting patterns and operational tempo remain consistent with state-sponsored intelligence collection priorities supporting Russian strategic interests in Ukraine. No new sanctions or policy measures have been announced in connection with this 2025 campaign expansion, though Gamaredon remains under existing Western sanctions frameworks targeting Russian cyber actors.

Business Impacty pro region

The intensification of Gamaredon operations underscores the enduring cyber dimension of the Russia-Ukraine conflict and the persistent threat to Ukrainian critical infrastructure, government networks, and civil society. For European allies, this activity reinforces the need for continued cyber defense cooperation with Kyiv, including intelligence sharing, technical assistance, and resilience-building programs. The potential involvement of Slovakia—whether as a targeting vector, infrastructure node, or transit point—highlights the regional spillover risks of Russian cyber operations and the vulnerability of Central European states hosting Ukrainian refugees or support networks. NATO and EU member states may face increased pressure to enhance collective cyber defense postures and attribution mechanisms as Russian APT activity remains undiminished despite sanctions.

Forecast

If Gamaredon maintains its current operational tempo, Ukrainian defenders are likely to face sustained spear-phishing and malware campaigns throughout 2025, requiring continued investment in detection capabilities and user awareness training. Should the group's cloud service abuse tactics prove effective in evading detection, other Russian APT actors may adopt similar techniques, complicating attribution and response efforts. If Western intelligence and cybersecurity communities observe further targeting in Slovakia or other Central European states, this may indicate an expansion of Russian collection priorities beyond Ukraine proper, potentially triggering enhanced defensive coordination within NATO and EU frameworks. Absent significant operational disruption or policy consequences, Gamaredon activity is expected to persist at elevated levels consistent with ongoing conflict dynamics.