Home › Threat Actors › Gamaredon
← All Threat Actors
Nation-State high Russia

Gamaredon

Russian state-sponsored (FSB) · Espionage / intelligence collection / disruption pre-positioning

Reports 1
Active Since 2014
Last Reported 8 Jun 2026
Sectors Targeted critical-infrastructure, communications, ot-ics

Tactics, Techniques & Procedures (TTPs)

  • HTML smuggling via weaponised XHTML attachments — evades email gateway attachment filtering
  • CVE-2025-8088 WinRAR path traversal exploitation — archive extracts HTA to Startup folder without user interaction
  • Gamma framework: GammaPhish (delivery), GammaLoad (staging), GammaWorm (USB propagation), GammaSteel (data theft), GammaWipe (destructive wiper)
  • Telegram dead drop resolvers — current C2 IP stored in attacker-controlled Telegram channel, rotated to outpace blocklists
  • Four-stage VBScript loader cascade — each stage fingerprints host, updates C2 config, fetches next stage
  • Startup folder HTA persistence via mshta.exe with obfuscated URL arguments mimicking legitimate domains

Known Targets

Ukrainian government ministriesUkrainian military and intelligence personnelUkrainian law enforcementEnergy and telecommunications operators in UkraineUkrainian diaspora organisations

Analyst Notes

Publicly attributed to Russia's FSB by Ukraine's Security Service (SBU) in 2021, with named FSB officers identified — an unusually specific public attribution. One of the most operationally active nation-state groups globally by campaign frequency. The 2026 Gamma framework represents a significant modularisation: individual components can be updated or withheld depending on the target and phase, and defenders detecting GammaLoad cannot assume intelligence on GammaSteel without recovering live payloads. CVE-2025-8088 was simultaneously exploited by Sandworm and Turla in the same timeframe, indicating rapid cross-operator exploit adoption within Russia's offensive ecosystem. Primary targeting is Ukraine, but organisations with Ukraine-related contacts represent elevated exposure.

Also Known As

Primitive BearAqua BlizzardACTINIUMShuckwormUAC-0010Armageddon

MITRE ATT&CK Techniques

T1566.001 Phishing: Spearphishing Attachment T1203 Exploitation for Client Execution T1547.001 Boot/Logon Autostart: Registry Run Keys / Startup Folder T1102 Web Service (Telegram dead drop resolver) T1091 Replication Through Removable Media

Intelligence Reports

Analysis critical-infrastructurecommunications

Gamaredon in 2026: Russia's Most Persistent APT Upgrades to a Modular Framework and Exploits WinRAR for Initial Access

Gamaredon (Primitive Bear, Aqua Blizzard) — Russia's FSB-linked APT targeting Ukraine since 2014 — has deployed a newly modularised malware framework in 2026, using HTML smuggling and CVE-2025-8088 WinRAR exploitation for initial access. Sekoia's June 2026 analysis reveals a four-stage VBScript loader chain, Telegram-based dead drop resolvers, and five distinct payload families covering every phase of the kill chain.

8 Jun 2026 · 10 min read