Gamaredon_Group__2022__Microsoft_ACTINIUM-Ukrainian-organizations_02-04-2022.pdf

Microsoft MSTIC details ACTINIUM (aka Gamaredon), an FSB‑attributed, long‑running cyber‑espionage campaign targeting Ukrainian government, military, NGOs, judiciary, law enforcement and related organizations; the group uses spear‑phishing with remote templates, staged VBS/PowerShell payloads, scheduled‑task persistence, and multiple malware families (PowerPunch, Pterodo, QuietSieve) to maintain access and exfiltrate sensitive data, and the report provides extensive IOCs (domains, IPs, SHA‑256s), observed wordlists, and detection/hunting queries for Microsoft security products.