Beyond_Bullets_and_Bombs_An_Examination_of_Armageddon_Groups_Cyber.pdf

This report analyzes Armageddon (aka Gamaredon) activity against Ukrainian targets, detailing spearphishing delivery (RTF/DOCX/LNK), remote template injection to fetch stages, mshta/VBScript/PowerShell/PE payloads, persistence mechanisms, and abuse of Telegram for C2 resolution, and provides associated IOCs (hashes, IPs, URLs, Telegram channels) and MITRE ATT&CK mappings to support detection and mitigation.