Gamaredon ramps up Ukraine spear-phishing with new malware and cloud abuse

Intelligence Summary

ESET reports the Russian APT group Gamaredon increased its operations against Ukraine through 2025. The activity included 35 spear-phishing campaigns targeting new victims, many launching in the latter half of the year. The intrusions involved both malware additions and abuse of cloud services for staging or delivery. This combination can help attackers evade controls and maintain persistence across environments. Organizations with Ukrainian exposure should review email security, harden cloud credentials, and hunt for Gamaredon indicators. Incident response teams should also validate outbound access and suspicious authentication patterns in cloud logs.

Recommended Action

Review affected assets, schedule urgent remediation, and monitor related indicators.

Topics