gamaredon-in-2025.pdf

## Executive summary This white paper details Gamaredon's 2025 activity: targeted spearphishing campaigns (35 identified) against Ukrainian government and military entities, the introduction of six new PowerShell/VBScript tools and multiple updates to existing malware (file stealers, weaponizers, downloaders), abuse of third-party services (Cloudflare workers/tunnels, PaaS, dead-drop platforms) to hide C2 infrastructure, and use of CVE-2025-8088 in WinRAR for automatic persistence and distribution; extensive IOCs and host/network artifacts are provided.