Loading story…
Ukraine’s Security Service (SSU) publicly identified five alleged members of the Gamaredon cyber-espionage group and said the operators worked from Sevastopol, Crimea, under the direction of Russia’s FSB Center 18. The SSU said it issued high-treason notices and released intercepted calls to support its claims, marking a rare public attribution of the group to a named Russian security service. Ukrainian authorities said Gamaredon had operated since 2013 and carried out more than 5,000 cyberattacks against over 1,500 Ukrainian government systems, focusing on intelligence collection from security, defense, and law-enforcement bodies.
Reporting and threat tracking describe Gamaredon—also known as Armageddon, Shuckworm, Primitive Bear, Trident Ursa, ACTINIUM, DEV-0586, and UAC-0010—as a long-running Russian espionage actor that primarily targets Ukrainian state entities, with some activity extending to European institutions. The group is known for spearphishing and spoofed emails carrying malicious Office documents, macros, VBScript, PowerShell, and batch files, along with malware such as Pterodo/Pteranodon, GammaLoad, GammaDrop, GammaSteel, and QuietSieve. Analysts also link the actor to evasive infrastructure including dynamic DNS, fast-flux hosting, dead-drop resolvers, and Telegram- or GitHub-linked delivery and control mechanisms, as well as data theft, screenshot capture, remote access, and destructive actions such as file wiping and desktop defacement.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
18 events from the most recent confirmed update back to the earliest known activity.
HarfangLab published a 2026 report describing Gamaredon's infection chain as using spoofed emails, GammaDrop, and GammaLoad. The report provided updated technical detail on the group's delivery and staging methods.
ClearSky referenced GamaWiper in connection with Gamaredon-related reporting in 2025. This added another malware component to the actor's publicly associated toolset.
Malpedia cites a 2025 ESET reference describing a Gamaredon and Turla collaboration involving PteroGraphin. This introduced a reported operational link between the two Russian threat actors.
HarfangLab published a 2025 report on Gamaredon's PteroLNK, describing dead-drop resolvers and evasive infrastructure. The report added technical detail on the group's command-and-control tradecraft.
Lookout reported in 2024 that it discovered two Russian Android spyware families from Gamaredon named BoneSpy and DroidWatcher. This expanded public understanding of the group's tooling into mobile surveillance malware.
ThreatMon published a 2023 technical analysis of an Armageddon infostealer called Cybergun. Malpedia includes this as part of the group's malware ecosystem documentation.
BlackBerry reported in January 2023 that Gamaredon abused Telegram to target Ukrainian organizations. The reporting highlighted Telegram-linked delivery or control mechanisms in the actor's operations.
Unit 42 published further reporting on Gamaredon in July 2022. Malpedia cites this as another public analytical milestone in tracking the actor's activity.
CERT-UA reported in April 2022 that UAC-0010/Armageddon had targeted state institutions of European Union countries. This marked documented activity beyond Ukrainian targets in the cited reporting.
Unit 42 published reporting in February 2022 on Gamaredon, including use of the alias Trident Ursa. Malpedia lists this as part of the actor's 2022 public reporting trail.
Microsoft published reporting in February 2022 stating that ACTINIUM, an alias for Gamaredon, targeted Ukrainian organizations. This added to public documentation of the group's sustained activity against Ukraine.
CERT-UA published reporting in 2022 linking UAC-0010 to GammaLoad and GammaSteel malware. The same year, CERT-UA also issued alerts about use of GammaLoad.PS1_v2.
CERT-UA reported cyberattacks by UAC-0010/Armageddon against state organizations of Ukraine in 2022. The reporting tied the activity to Gamaredon and its ongoing espionage campaigns.
The SSU publicly identified five alleged Gamaredon members, said they operated from Sevastopol, Crimea, and linked the group to Russia's FSB Center 18 in Moscow. The agency also said it issued notices of high treason and released intercepted phone conversations and a 35-page technical report.
ESET published reporting in 2020 stating that the Gamaredon group was expanding its operations. Malpedia includes this as part of the actor's evolving campaign history.
CERT-UA reported mass or bulk mailing campaigns in 2018 delivering Pterodo-type spyware associated with Gamaredon. This reflects one of the group's documented phishing-based malware delivery efforts.
A 2015 LookingGlass report titled "Operation Armageddon" documented the actor's cyber-espionage activity and framed it as part of Russian modern warfare. Malpedia cites this as one of the earliest public references in the group's reporting history.
The Ukrainian Security Service said the Gamaredon group began operating in June 2013. The group was later described as conducting cyberintelligence operations against Ukrainian state bodies.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
malpedia.caad.fkie.fraunhofer.de
Open sourcesocradar.io
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Russia-linked **Gamaredon**—also tracked as **Shuckworm**, **Primitive Bear**, **Trident Ursa**, and **STEADY#URSA**—conducted sustained cyber-espionage operations against Ukrainian government, military, and other public- and private-sector organizations, while also probing at least one petroleum refining company in a NATO member state. Researchers reported a sharp rise in email-borne attacks tied to the group, including a late-2022 surge against `gov.ua` subdomains and broader targeting of energy, media, financial, business, and non-profit entities. The actor increasingly used both Ukrainian- and English-language lures delivered through spearphishing emails, malicious attachments, phishing pages, and archive files to gain initial access and support intelligence collection. Across multiple campaigns, Gamaredon deployed evolving malware chains that included the **Pteranodon** backdoor, the **SUBTLE-PAWS** PowerShell backdoor, and at least eight additional custom payloads, alongside legitimate tools such as **UltraVNC** and **Process Explorer**. Intrusions used macro-enabled Word documents, remote template injection, `.lnk` shortcut files, VBS droppers, scheduled tasks, startup-folder persistence, registry `Run` keys, and repeated HTTP/HTTPS command-and-control callbacks, with some infrastructure hosted through Dynamic DNS, Telegraph pages, DNS-based retrieval, and network space linked to **AS9123 TimeWeb Ltd.** Researchers also observed USB propagation behavior, exploitation attempts for `CVE-2021-3438`, and suspicious `msiexec` activity, underscoring the group’s continued adaptation of tradecraft for long-term access and espionage in support of Russia’s war-related objectives.
Aug 15, 2026
The Russia-linked **Gamaredon** threat group, also tracked as **ACTINIUM**, **Primitive Bear**, **Shuckworm**, and **Aqua Blizzard**, has been tied to sustained spearphishing operations against Ukrainian government and state institutions. Reporting describes lure documents delivered through spoofed or compromised email accounts, with infection chains using remote template injection, **VBA macros**, and malware components including **GammaDrop**, **GammaLoadIdentifier**, and the custom backdoor **Pteranodon**. Researchers said the activity remained ongoing across multiple waves and was aimed at gaining initial access and maintaining footholds inside targeted environments. Technical analysis linked the campaign to abuse of **`CVE-2025-8088`**, startup-folder **VBScript** persistence, changes to Microsoft Word macro security registry settings, host identifier collection, and HTTP-based command-and-control communications over dynamic DNS-hosted infrastructure. Separate infrastructure research expanded on previously reported Gamaredon/ACTINIUM network assets by using passive DNS pivots, identifying domain and subdomain patterns, shared IP reuse, and additional likely attacker-controlled **`.ru`** domains consistent with the group’s broader operational infrastructure.
Aug 15, 2026
The Russia-linked **Gamaredon** espionage group—also tracked as **ACTINIUM**, **Shuckworm**, and **Primitive Bear**—has continued targeting Ukrainian government, military, security, and research organizations with large-scale intrusion activity, including thousands of attacks attributed by Ukraine’s SSU to FSB-linked operators. Microsoft and Symantec documented sustained campaigns using spear-phishing, malicious attachments, **PowerShell**, and **VBScript** malware to gain access, maintain persistence, and steal sensitive information such as military reports, arsenal inventories, and personnel data. Check Point said the group added a newly identified **VBS-based USB worm** called **LitterDrifter**, which spreads through removable drives by planting hidden copies and malicious `.lnk` shortcuts while maintaining command-and-control through rapidly changing infrastructure. Researchers said the malware uses randomized subdomains of hardcoded `.ru` domains and can fall back to **Telegram** channels for C2 resolution, matching Gamaredon’s pattern of volatile infrastructure and frequent tool updates. Although the campaign remains focused on Ukraine, infections were also observed in countries including the United States, Vietnam, Chile, Poland, Germany, and Hong Kong, likely caused by uncontrolled USB propagation rather than deliberate targeting.
Aug 14, 2026