Gamaredon

Symantec disclosed a February–March 2025 Shuckworm campaign against the Ukraine-based mission of a Western military, in which the operators delivered an updated PowerShell variant of the GammaSteel infostealer. Initial access came via an infected removable drive triggering a malicious 'files.lnk' shortcut, with command and control rotated across trycloudflare[.]com tunnels and a Tor-fallback cURL channel for exfiltration.

Symantec's Threat Hunter Team reported sustained Shuckworm (Gamaredon) intrusions against Ukrainian security, military and government organizations between February and May 2023, with some intrusions persisting for up to three months. The operators sought reporting on Ukrainian service members, battlefield engagements, air strikes and arsenal inventories, and deployed a new PowerShell USB-propagation script to spread the Pterodo backdoor across air-gapped or removable media.

Cisco Talos documented an ongoing Gamaredon espionage campaign running through August 2022 that targeted Ukrainian government agencies with malicious LNK files delivered inside RAR archives. The infection chain relied on PowerShell and VBScript loaders to deploy a custom information stealer alongside the GammaLoad and GammaSteel implants, with lure themes referencing the Russian invasion.

CISA, FBI, NSA and partner agencies from Australia, Canada, New Zealand and the United Kingdom issued joint advisory AA22-110A on Russian state-sponsored and criminal cyber threats to critical infrastructure. The advisory cited Primitive Bear (Gamaredon) as a long-running FSB-attributed actor targeting Ukrainian government, military and law enforcement entities since at least 2013, reaffirming Ukraine's November 2021 attribution to FSB Center 18.

Microsoft Threat Intelligence Center (MSTIC) published a detailed report on ACTINIUM — Microsoft's tracking name at the time for Gamaredon, later renamed Aqua Blizzard. The report documented spear-phishing with malicious remote-template macro documents targeting Ukrainian government, military, judiciary, law enforcement, NGOs and humanitarian coordination bodies since October 2021, and described seven custom malware families including PowerPunch, Pterodo and QuietSieve.

The Security Service of Ukraine (SBU) publicly attributed the Gamaredon / Armageddon intrusion set to Russia's FSB Center for Information Security (Center 18) operating out of occupied Sevastopol, Crimea. The disclosure named five FSB officers — Sklianko, Chernykh, Starchenko, Miroshnychenko, and Sushchenko — and stated the group had conducted more than 5,000 cyberattacks against Ukrainian government and critical infrastructure systems since 2014.