Gamaredon_Group__2022__Shuckworm_APT.pdf

### Shuckworm (Gamaredon) cyber-espionage against Ukraine Symantec documents active, long-running Russian-linked Shuckworm campaigns targeting Ukrainian organizations using phishing-delivered malicious documents that deploy VBS-based Pterodo backdoors, 7-zip SFX droppers, scheduled tasks, and remote-access tools (UltraVNC/RMS), with detailed case timeline, malware technicals, C2 patterns, and IOCs for detection and mitigation.