← threat actors
threat actor · not yet in the cluster map
gamaredon
4 stories · 4 in the wild · June 19, 2026 – June 26, 2026
evidence: 4 observed
how they got in
- phishing email 3 · Jun 26
sectors
- government 4 · Jun 26
- defense 2 · Jun 26
malware and tools
- pterocache 1 · Jun 26
- pterodee 1 · Jun 26
- pterodum 1 · Jun 26
- pteroeffigy 1 · Jun 26
- pteroodd 1 · Jun 26
- pteropaste 1 · Jun 26
- pterosetup 1 · Jun 26
techniques
- path traversal 3 · Jun 21
- persistence 2 · Jun 21
- command and control 1 · Jun 26
- credential access 1 · Jun 26
- phishing 1 · Jun 26
- code execution 1 · Jun 21
attack phases seen
- Initial access 4 · Jun 26
- Execution 3 · Jun 21
- Persistence 2 · Jun 21
- Command and control 1 · Jun 26
what we reported, newest first, grouped by story
June 26, 2026
- ESET detailed Gamaredon's 2025 evolution: six new PowerShell downloaders (PteroDee, PteroDum, PteroPaste, PteroOdd, PteroEffigy, PteroCache) plus the revived PteroSetup weaponizer, 35 spear-phishing campaigns against Ukrainian government/military, and heavy infrastructure laundering via Cloudflare Workers, Microsoft dev tunnels, Loophole, and dead drops on Telegram, Telegraph, Rentry, Dropbox, Supabase and Clever Cloud. WeLiveSecurity, whitepaper + IOCs
· Jun 26 · observed · via phishing email · Threat Intelligence
Jun 19 – June 21, 2026 · 3 reports
- Gamaredon is exploiting the WinRAR path-traversal flaw CVE-2025-8088 against Ukrainian targets: military/conscription-themed
.rar lures use a malicious NTFS alternate data stream to silently plant a .lnk into the Startup folder on extraction, executing a hidden PowerShell stager on next logon. Active since February 2026 and ongoing (Nextron).
· Jun 21 · observed · via phishing email · Vulnerabilities & Exploits - Gamaredon is weaponizing CVE-2025-8088 (WinRAR path traversal) against Ukrainian military/conscription targets since February 2026: a malicious NTFS alternate data stream plants a
.lnk into the Startup folder on extraction, firing a hidden PowerShell stager with anti-analysis checks on next logon. Nextron
· Jun 20 · observed · Threat Intelligence & Espionage - Gamaredon is weaponizing WinRAR path-traversal CVE-2025-8088 against Ukraine: a malicious NTFS alternate data stream plants a
.lnk directly into the Startup folder on archive extraction, then runs a hidden anti-analysis PowerShell stager. Campaign active since February 2026 with military/conscription lures (Nextron).
· Jun 19 · observed · via phishing email · Nation-State & APT