Loading malware…
Gamaredon, also tracked as Shuckworm, Armageddon, Primitive Bear, ACTINIUM, and Callisto, is a Russia-linked cyber-espionage threat actor associated with long-running operations against Ukrainian entities since at least 2013. It has consistently targeted government, law enforcement, and defense organizations in Ukraine and is known for broad, persistent, and often noisy intrusion activity oriented toward intelligence collection and sustained access.
Gamaredon commonly uses phishing and spearphishing to gain initial access, including malicious attachments and Windows shortcut files. Its operations have also involved malicious documents, LNK-based delivery chains, and exploitation of WinRAR path traversal vulnerability CVE-2025-8088 to deliver malware through crafted archives. In some campaigns, opening a malicious archive resulted in silent placement of malware into startup persistence locations. The group has also been associated with propagation via removable media using LNK-based tooling.
The actor’s tooling includes the Ptero malware ecosystem, with components such as PteroLNK and PteroGraphin observed in Ukrainian intrusions. Reported behaviors include downloading and executing second-stage payloads, maintaining persistence, and supporting follow-on espionage activity. Gamaredon has been linked to phishing campaigns carrying malware attachments and to operational use of LNK files as an initial-access mechanism.
In 2025, Gamaredon was observed in co-compromises with Turla on Ukrainian systems, where Gamaredon activity preceded deployment of Turla’s Kazuar backdoor on selected machines. This suggested that Gamaredon’s broad access operations may have enabled more selective follow-on espionage by Turla. In at least one case, a Gamaredon implant was reportedly used to restart Turla malware, and Gamaredon was also reported to have deployed Kazuar directly on some targets.
Gamaredon is best characterized as an espionage-oriented malware and intrusion ecosystem rather than a single standalone family. Its activity is strongly associated with Ukrainian targeting, phishing-led compromise, LNK-based execution chains, persistence, and post-compromise support for additional payload deployment.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Gamaredon In June 2022, Inquest published a report about a new threat actor called Glowsand that was targeting Ukranian entities using phishing emails with malicious documents and LNK files to download and execute second stage payloads.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
APT group known for using custom malware loaders and exploiting vulnerabilities to deliver payloads, often targeting Ukrainian government entities.
Gamaredon is a Russian state-backed APT group focused on cyberespionage, primarily targeting Ukrainian government, law enforcement, and defense organizations. It is known for using spear-phishing and malicious LNK files for initial access, and for deploying a variety of custom tools such as PteroLNK, PteroStew, PteroOdd, PteroEffigy, and PteroGraphin.
The report links LNK metadata from Glowsand-attributed samples to previous Gamaredon campaigns, including campaigns targeting Ukrainian organizations. The LNK files were used to download and execute second-stage payloads, and some later samples included embedded garbage digital-signature data likely intended to confuse AV scanners.
APT group known for phishing campaigns delivering malware via malicious attachments, primarily targeting Ukrainian entities.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.