Gamaredon Expanded Ukraine Espionage With New PowerShell Tools and Cloud-Hidden C2

Russia-aligned Gamaredon significantly upgraded its cyberespionage operations against Ukrainian government and military organizations during 2025, according to ESET. The group ran 35 spear-phishing campaigns, introduced six new PowerShell-based tools, revived the VBScript weaponizer PteroSetup, and exploited CVE-2025-8088 in WinRAR to establish persistence through malicious HTA downloaders placed in Startup folders. ESET said Gamaredon also expanded lateral movement and USB-based propagation, with the newly documented PteroPaste able to copy a malicious downloader to connected USB drives while disguising it as a Word document shortcut.

The group increasingly concealed command-and-control and data theft behind legitimate services, using Cloudflare Workers, Microsoft dev tunnels, Loophole, DDNS providers, messaging and blogging platforms, paste sites, and cloud storage to mask malicious traffic and stage payloads. Newer malware variants retrieved encrypted C2 data from dead-drop locations such as Telegram, Dropbox, GoFile, and Mastodon, while upgraded stealers including PteroPSDoor and PteroVDoor exfiltrated stolen files to S3-compatible storage such as Wasabi, Tebi, and Intercolo. ESET also observed Gamaredon collaborating with Turla in early 2025, providing initial access that supported deployment of the Kazuar framework.