Gamaredon Expands Ukraine Attacks with New Malware and Cloud Service Abuse

Russian state-sponsored threat actors continue to demonstrate an alarming evolution in their cyber warfare capabilities, particularly in their persistent targeting of Ukraine. The Gamaredon group, operating with apparent state backing, has significantly expanded its offensive operations throughout 2025, developing new malware variants and sophisticated attack vectors that represent an escalating threat to national security and critical infrastructure.

According to research from Slovakian cybersecurity firm ESET, Gamaredon has launched at least 35 distinct spear-phishing campaigns against Ukrainian targets this year, with the majority occurring in the latter half of 2025. What makes these attacks particularly concerning is the group's continuous development of new malware families and their strategic abuse of legitimate cloud services to deliver malicious payloads. By leveraging trusted platforms and services, the threat actors effectively bypass traditional security controls, making detection significantly more challenging for organizations.

The primary victims of these campaigns include Ukrainian government agencies, critical infrastructure providers, and organizations strategically important to national defense. This focused targeting aligns with broader geopolitical objectives, highlighting the intersection between cyber operations and traditional warfare. The attacks are not random but carefully orchestrated to maximize disruption, intelligence gathering, and potentially establish long-term persistence within high-value networks.