Gamaredon

Profile narrative

Gamaredon, also tracked under the aliases Primorye and Shuckworm, is a threat actor assessed to operate from Russia and linked to Russian state security services. Ukrainian authorities have publicly tied the group to the Federal Security Service (FSB), while research describes it as a Russia‑linked advanced persistent threat group conducting cyber‑espionage and disruption against Ukrainian targets. Its activity focuses on Ukrainian governmental entities, military institutions, diplomatic missions, law‑enforcement agencies, state‑owned banks such as Privatbank and Oschadbank, and broader critical‑infrastructure sectors including energy, IT and media. The group's observed objectives include gathering intelligence on Ukrainian national security, preserving persistent access for future operations, and conducting information‑warfare actions that aim to undermine public trust, sow panic and degrade the availability of services.

Gamaredon’s toolkit relies heavily on spear‑phishing messages that carry weaponized documents employing template injection to download malicious templates from remote servers. These documents often contain VBA macros that write a VBScript to the startup folder, which after reboot contacts a dynamic‑DNS domain to fetch an encrypted second‑stage payload only if the victim is deemed of interest. The group uses self‑extracting archives (SFX) that bundle batch scripts, .NET components and macro payloads, sometimes incorporating a Microsoft.Vbe.Interop component and falsified Microsoft Time‑Stamp Service certificates to evade detection. In addition to persistence mechanisms, Gamaredon has deployed a range of destructive wiper malware families such as WhisperGate, FoxBlade (also known as HermeticWiper), Industroyer2, CaddyWiper, DesertBlade, FiberLake and SonicVote, and has abused legitimate Windows utilities like SecureDelete for data destruction. Its infrastructure frequently leverages Nginx forwarders and dynamic‑DNS providers to route traffic from compromised hosts.

Representative operations attributed to Gamaredon include a February 2022 distributed denial‑of‑service campaign that disrupted the websites of Ukraine’s Ministry of Defense, Armed Forces and the state‑owned banks Privatbank and Oschadbank, accompanied by fraudulent SMS messages falsely reporting ATM outages as part of an information attack. In March 2022 the group was linked to a deepfake video that falsely showed Ukraine’s president ordering troops to surrender, which was disseminated through compromised news sites and social media before being removed. Earlier, in late 2019 Gamaredon conducted a spear‑phishing campaign targeting Ukrainian diplomats, government officials and the Ministry of Foreign Affairs using template‑injected lure documents, and in late 2019‑early 2020 it was observed conducting reconnaissance against the Hetman Petro Sahaidachnyi National Ground Forces Academy, deploying updated Pterodo implants that collected system data and communicated with command‑and‑control servers. The group has also been observed using the Pterodo backdoor, first detected by Ukrainian CERT in November 2018, which gathers host information and contacts hard‑drive‑derived URLs for further instructions.

Beyond these specific campaigns, Gamaredon’s activity has been described as part of a broader hybrid‑warfare effort that aligns cyber actions with kinetic military movements, seeking to degrade Ukrainian government and military functions while influencing the information environment. The group’s reliance on living‑off‑the‑land tools, regularly updated malware variants and dynamic‑DNS infrastructure reflects a focus on maintaining operational stealth and the ability to re‑tool quickly for successive waves of intrusion. Public reporting consistently connects the actor to Russian state interests, noting its repeated targeting of Ukrainian national‑security targets and its use of tactics previously associated with Russian‑linked threat groups.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 6 sources.