Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset
Essential information
- Published
- 04/07/2025 10:34
- Modified
- 04/07/2025 10:53
- Tags
- 2025-07-04 apt cloudflare tunnels powershell spearphishing
- Related entities
- 53 observables, 1 intrusion sets (apt), 12 malware, 2 others
Description
Throughout 2024, Gamaredon focused exclusively on targeting Ukrainian governmental institutions with spearphishing campaigns and weaponized USB drives. The group developed six new tools and significantly updated existing ones, improving stealth and evasion capabilities. Gamaredon increased the scale of its spearphishing campaigns, especially in the second half of the year. The group also made efforts to bypass network-based blocking, hiding most of its command and control infrastructure behind Cloudflare tunnels. Notable updates include enhancements to PteroLNK for weaponizing network drives, improvements in file exfiltration techniques, and the introduction of new downloaders. Despite these advancements, Gamaredon showed signs of operational limitations, occasionally abandoning or infrequently updating certain tools.