Loading story…
The Russia-linked Gamaredon espionage group—also tracked as ACTINIUM, Shuckworm, and Primitive Bear—has continued targeting Ukrainian government, military, security, and research organizations with large-scale intrusion activity, including thousands of attacks attributed by Ukraine’s SSU to FSB-linked operators. Microsoft and Symantec documented sustained campaigns using spear-phishing, malicious attachments, PowerShell, and VBScript malware to gain access, maintain persistence, and steal sensitive information such as military reports, arsenal inventories, and personnel data.
Check Point said the group added a newly identified VBS-based USB worm called LitterDrifter, which spreads through removable drives by planting hidden copies and malicious .lnk shortcuts while maintaining command-and-control through rapidly changing infrastructure. Researchers said the malware uses randomized subdomains of hardcoded .ru domains and can fall back to Telegram channels for C2 resolution, matching Gamaredon’s pattern of volatile infrastructure and frequent tool updates. Although the campaign remains focused on Ukraine, infections were also observed in countries including the United States, Vietnam, Chile, Poland, Germany, and Hong Kong, likely caused by uncontrolled USB propagation rather than deliberate targeting.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
Check Point reported indications of LitterDrifter infections in the United States, Vietnam, Chile, Poland, Germany, and Hong Kong. The researchers assessed these were likely caused by uncontrolled USB propagation rather than deliberate targeting.
On November 17, 2023, Check Point Research published analysis of LitterDrifter, a newly identified VBScript-based USB worm used by Gamaredon. The malware spreads via removable drives and maintains command-and-control access using randomized .ru domains with a Telegram fallback.
On June 15, 2023, Symantec published details of Shuckworm's ongoing espionage campaign, including use of phishing, Pterodo, likely Giddome, short-lived infrastructure, and a new USB-propagation PowerShell script. The report also highlighted Telegram and Telegraph use for command and control.
Symantec said some intrusions that began in February or March 2023 persisted until May 2023, with certain compromises lasting as long as three months. During these intrusions, the group sought military, personnel, and government information.
Symantec reported that the campaign's attacks largely began in February and March 2023, targeting Ukrainian military, security, research, and government organizations. Initial access commonly came through spear-phishing emails carrying malicious attachments.
Between January and April 2023, Symantec observed up to 25 new variants per month of Shuckworm PowerShell script obfuscation. The change reflected frequent toolset refreshes intended to complicate tracking and detection.
Symantec noted it had previously documented four variants of the Backdoor.Pterodo malware family in April 2022. Those variants used VBS droppers, scheduled-task persistence, and downloaded additional code from command-and-control servers.
Microsoft published reporting on February 4, 2022, describing ACTINIUM activity against Ukrainian organizations. The reference establishes public reporting on the group's operations against Ukraine by that date.
Symantec said the Russia-linked Shuckworm/Gamaredon group has focused almost exclusively on Ukrainian targets since 2014. The activity forms the long-running backdrop for later campaigns and tooling changes described in the references.
4 references tracked. Mallory keeps watching after this page renders.
research.checkpoint.com
Open sourcesymantec-enterprise-blogs.security.com
Open sourcemicrosoft.com
Open sourcessu.gov.ua
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Russia-linked **Gamaredon**—also tracked as **Shuckworm**, **Primitive Bear**, **Trident Ursa**, and **STEADY#URSA**—conducted sustained cyber-espionage operations against Ukrainian government, military, and other public- and private-sector organizations, while also probing at least one petroleum refining company in a NATO member state. Researchers reported a sharp rise in email-borne attacks tied to the group, including a late-2022 surge against `gov.ua` subdomains and broader targeting of energy, media, financial, business, and non-profit entities. The actor increasingly used both Ukrainian- and English-language lures delivered through spearphishing emails, malicious attachments, phishing pages, and archive files to gain initial access and support intelligence collection. Across multiple campaigns, Gamaredon deployed evolving malware chains that included the **Pteranodon** backdoor, the **SUBTLE-PAWS** PowerShell backdoor, and at least eight additional custom payloads, alongside legitimate tools such as **UltraVNC** and **Process Explorer**. Intrusions used macro-enabled Word documents, remote template injection, `.lnk` shortcut files, VBS droppers, scheduled tasks, startup-folder persistence, registry `Run` keys, and repeated HTTP/HTTPS command-and-control callbacks, with some infrastructure hosted through Dynamic DNS, Telegraph pages, DNS-based retrieval, and network space linked to **AS9123 TimeWeb Ltd.** Researchers also observed USB propagation behavior, exploitation attempts for `CVE-2021-3438`, and suspicious `msiexec` activity, underscoring the group’s continued adaptation of tradecraft for long-term access and espionage in support of Russia’s war-related objectives.
Aug 15, 2026
The Russia-linked **Gamaredon** threat group, also tracked as **ACTINIUM**, **Primitive Bear**, **Shuckworm**, and **Aqua Blizzard**, has been tied to sustained spearphishing operations against Ukrainian government and state institutions. Reporting describes lure documents delivered through spoofed or compromised email accounts, with infection chains using remote template injection, **VBA macros**, and malware components including **GammaDrop**, **GammaLoadIdentifier**, and the custom backdoor **Pteranodon**. Researchers said the activity remained ongoing across multiple waves and was aimed at gaining initial access and maintaining footholds inside targeted environments. Technical analysis linked the campaign to abuse of **`CVE-2025-8088`**, startup-folder **VBScript** persistence, changes to Microsoft Word macro security registry settings, host identifier collection, and HTTP-based command-and-control communications over dynamic DNS-hosted infrastructure. Separate infrastructure research expanded on previously reported Gamaredon/ACTINIUM network assets by using passive DNS pivots, identifying domain and subdomain patterns, shared IP reuse, and additional likely attacker-controlled **`.ru`** domains consistent with the group’s broader operational infrastructure.
Aug 15, 2026
Ukraine’s Security Service (**SSU**) publicly identified five alleged members of the **Gamaredon** cyber-espionage group and said the operators worked from Sevastopol, Crimea, under the direction of Russia’s **FSB Center 18**. The SSU said it issued high-treason notices and released intercepted calls to support its claims, marking a rare public attribution of the group to a named Russian security service. Ukrainian authorities said Gamaredon had operated since 2013 and carried out more than **5,000 cyberattacks** against over **1,500** Ukrainian government systems, focusing on intelligence collection from security, defense, and law-enforcement bodies. Reporting and threat tracking describe Gamaredon—also known as **Armageddon**, **Shuckworm**, **Primitive Bear**, **Trident Ursa**, **ACTINIUM**, **DEV-0586**, and **UAC-0010**—as a long-running Russian espionage actor that primarily targets Ukrainian state entities, with some activity extending to European institutions. The group is known for spearphishing and spoofed emails carrying malicious Office documents, macros, VBScript, PowerShell, and batch files, along with malware such as **Pterodo/Pteranodon**, **GammaLoad**, **GammaDrop**, **GammaSteel**, and **QuietSieve**. Analysts also link the actor to evasive infrastructure including dynamic DNS, fast-flux hosting, dead-drop resolvers, and Telegram- or GitHub-linked delivery and control mechanisms, as well as data theft, screenshot capture, remote access, and destructive actions such as file wiping and desktop defacement.
Aug 15, 2026