Gamaredon_Group__2022__CiscoTalos_GamaredonAPT-targets-Ukrainian-new-campaign_09-15-2022.pdf

Gamaredon APT is running a targeted espionage campaign against Ukrainian government and affiliated organizations using spear-phishing Office documents that lead to LNK-triggered mshta execution and modular PowerShell/VBScript payloads; attackers deploy a custom information stealer that exfiltrates sensitive files, supports follow-on payload delivery, and uses multiple C2 domains/IPs and persistence mechanisms — the report includes detailed technical analysis, IOCs, and mitigation guidance.