Russian-aligned APT group Gamaredon continued to evolve its malware toolkit throughout 2025, maintaining a strong operational focus on Ukrainian government and military targets.
According to ESET Research, the group carried out 35 distinct spear-phishing campaigns against new targets, with most activity taking place in the second half of the year. ESET says Gamaredon remained focused solely on Ukraine, with the goal of stealing sensitive information that could support Russian interests in the ongoing war. ESET Research
Why Gamaredon Still Matters
Gamaredon is not known for highly complex malware compared with some other state-backed groups.
Its strength is persistence.
The group relies on frequent updates, large-scale spear-phishing, simple but effective malware, and creative abuse of legitimate online services. That combination makes its campaigns difficult to fully disrupt.
In 2025, ESET observed Gamaredon expanding its toolset, improving persistence, and hiding more of its infrastructure behind third-party services such as tunnels, serverless workers, cloud storage, and paste platforms.
Spear-Phishing Remains the Main Entry Point
Gamaredon’s campaigns continue to rely heavily on spear-phishing.
The attacks use archive attachments or XHTML files that perform HTML smuggling to deliver malicious HTA downloaders. These downloaders then fetch additional payloads such as PteroSand.
Some campaigns also abused a patched WinRAR vulnerability, CVE-2025-8088, to place a malicious HTA downloader inside the victim’s Windows Startup folder.
That gives the attackers persistence.
Once the user logs in again, the downloader can automatically execute and continue the compromise chain.
USB and Network Drive Weaponization
Gamaredon also continues to use tools designed for lateral movement.
Weaponizers such as PteroLNK and PteroPaste infect USB drives and network drives with malicious LNK files.
When another user opens one of these files, it can trigger the download of additional malware.
This technique is especially dangerous in government and military environments, where shared drives, removable media, and internal document workflows may still be common.
The group also revived PteroSetup, an older VBScript weaponizer first seen in 2021.
PteroSetup scans USB and mapped network drives for legitimate installer files. When it finds one, it replaces it with a 7z self-extracting archive containing both the original installer and a malicious VBScript downloader.
That means the victim may believe they are launching a normal installer, while the malware runs in the background.
6️⃣ Six New PowerShell Tools Added in 2025
One of the biggest changes in Gamaredon’s 2025 activity was the introduction of six new malicious PowerShell tools.
These include:
- PteroDee: fetches and executes PowerShell payloads in memory
- PteroCache: fetches and executes PowerShell payloads in memory
- PteroDum: fetches and executes VBScript payloads in memory
- PteroOdd: fetches a PowerShell payload using the Telegra.ph API
- PteroEffigy: retrieves command-and-control details using GoFile
- PteroPaste: weaponizes USB drives and downloads additional PowerShell payloads through an encrypted channel
ESET described PteroPaste as one of the more notable additions because it combines multiple functions, including downloading, USB weaponization, persistence, and orchestration. ESET Research
Abuse of Legitimate Services Is Growing
A key trend in Gamaredon’s 2025 operations is the growing abuse of legitimate online platforms.
Instead of exposing its real infrastructure directly, the group increasingly uses public services as dead drops, resolvers, and exfiltration channels.
Reportedly abused services include:
- Telegra.ph
- Teletype
- Rentry.co
- Write.as
- Dropbox
- GoFile
- DEV Community
- Mastodon
- Lesma
- Nopaste.net
- Paste.ee
- Wasabi
- Tebi
- Intercolo
This approach makes detection and disruption harder.
Traffic to legitimate cloud, paste, blogging, or storage services may not look suspicious at first glance. Blocking all of them may also be impractical for many organizations.
That gives Gamaredon more flexibility while forcing defenders to focus on behavior, context, endpoint telemetry, and unusual access patterns.
Possible Collaboration With Turla
Another important development is the reported overlap between Gamaredon and Turla, another Russian state-linked threat group.
ESET previously reported that Gamaredon tools such as PteroOdd and PteroPaste were involved in activity connected to Turla operations against high-profile Ukrainian targets. ESET assessed with high confidence that the two FSB-linked groups were cooperating. ESET Research
That matters because Gamaredon may provide broad initial access, while a more selective group such as Turla could focus on the most valuable compromised systems.
For defenders, this means even a seemingly routine Gamaredon infection should be treated seriously.
It may create an entry point for more advanced follow-on operations.
What Defenders Should Watch For
Organizations defending Ukrainian or Ukraine-linked institutions should pay close attention to:
- suspicious archive attachments
- XHTML files delivered by email
- HTA execution
- unusual files created in Windows Startup folders
- PowerShell running from unexpected locations
- VBScript downloaders
- malicious LNK files on USB or network drives
- abnormal access to paste, blogging, tunnel, or cloud storage services
- unexpected connections to serverless worker platforms
- installer files replaced with self-extracting archives
The key is to monitor behavior across the full chain, not only individual malware names.
Gamaredon changes tooling often, but its operational patterns remain recognizable.
Recommended Defensive Actions
Security teams should prioritize:
- patching WinRAR and other archive tools
- blocking or alerting on suspicious HTA execution
- monitoring Windows Startup folder changes
- restricting script execution where possible
- inspecting PowerShell and VBScript activity
- scanning USB and shared network drives for suspicious LNK files
- applying email security controls for archive and XHTML attachments
- monitoring unusual use of cloud storage and paste services
- using EDR detections for living-off-the-land execution chains
- training users to treat file prompts, archives, and unexpected installers with caution
Gamaredon’s malware may be relatively simple, but its persistence and constant adaptation make it dangerous.
Final Thoughts
Gamaredon’s 2025 activity shows that state-backed cyber operations do not always need highly sophisticated malware to remain effective.
The group continues to rely on spear-phishing, persistence, removable media infection, frequent tooling updates, and abuse of legitimate services.
Its growing use of PowerShell tools, cloud storage, dead drops, tunnels, and serverless infrastructure makes its operations more flexible and harder to disrupt.
For defenders, the lesson is clear: simple malware combined with persistence, scale, and infrastructure creativity can still create serious national-security risk.
