Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances
ESET Research analyzes Gamaredon’s new toolset and the group’s growing reliance on legitimate online services to hide its C&C infrastructure and exfiltrate s...
Gamaredon
Russian FSB-linked group almost exclusively targeting Ukrainian government, military, and critical infrastructure with high-volume phishing campaigns.
Also known as: gamaredon, primitive bear, aqua blizzard, winterflounder, armageddon, trident ursa, shuckworm
AI Intelligence Brief cached
Edit Profile
Entity Relationships
Related YARA Rules View all on YARA Rules page →
90-Day Activity
Last 90 Days (2)
Last 90 Days
All Time
FSB Group Gamaredon Hides Worm in Windows Data Streams
FSB-linked Gamaredon concealed a fileless worm in NTFS data streams to spy on Ukraine targets