Loading threat actor…
Gamaredon is a Russia-aligned cyber-espionage threat actor that has persistently targeted Ukrainian entities since at least 2013. It is also tracked as Earth Dahu, Primitive Bear, Shuckworm, Aqua Blizzard, and UAC-0010. The group is known for sustained operations against Ukrainian government and military-related targets and for high-volume spear-phishing campaigns using topical lures tied to wartime, legal, and administrative themes. Recent activity shows Gamaredon exploiting CVE-2025-8088, a WinRAR path traversal vulnerability, to gain initial access into Ukrainian organizations. In these campaigns, weaponized archive files silently place malicious startup artifacts on victim systems while displaying decoy documents. The observed infection chain used an HTA dropped into the Startup folder, followed by execution through mshta.exe after reboot or logon. The HTA then retrieved additional VBScript and follow-on spyware components through infrastructure proxied via Cloudflare Workers and dynamic DNS services. The group also used deceptive URL formatting and phishing emails sent from compromised government or judicial accounts to increase credibility. Gamaredon has historically favored script-based tradecraft over more complex compiled malware, relying heavily on HTA, VBScript, and PowerShell-based delivery chains for persistence and post-compromise espionage. In the observed campaigns, its tooling and delivery patterns were consistent with long-running operations focused on intelligence collection from Ukrainian state and defense-related organizations. Victimology and tradecraft align with a state-directed espionage mission rather than financially motivated intrusion activity.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
Attributed origin per open-source reporting.
19 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
5 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Russia-aligned espionage activity targeting Ukraine, using the same CVE-2025-8088 WinRAR exploit chain to deliver espionage tools via HTML Application files loaded through Cloudflare Workers.
Russia-aligned espionage group exploiting CVE-2025-8088 against Ukrainian targets using script-based infection chains that drop HTA files for Startup execution, then load VBScript through Cloudflare Workers and Dynamic DNS infrastructure to deliver espionage modules.
A Russia-linked espionage group persistently targeting Ukraine, using the WinRAR CVE-2025-8088 exploit to drop an HTA file into the startup folder, then leveraging mshta, Cloudflare Workers, dynamic DNS, and VBScript to deliver spyware modules.
Uses CVE-2025-8088 in spear-phishing campaigns against Ukrainian organizations to drop HTA or VBScript files into Startup, execute via mshta.exe on next login, and deliver espionage modules; reporting also notes a wiper component delivered through the same chain.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.