Gamaredon_Group__2022__Symantec_Shuckworm-Cyber-Attacks-Ukraine_01-31-2022.pdf

**Executive Summary:** Symantec details ongoing cyber-espionage by the Russia-linked Shuckworm/Gamaredon group against Ukrainian organizations, describing phishing-delivered malicious documents that install VBS backdoors (Pterodo), use mshta and living‑off‑the‑land techniques, create scheduled tasks for persistence, and ultimately deploy remote-access tools (UltraVNC/RMS); the report includes a July–August 2021 case study, multiple file hashes, C2 domains/IPs, and IOC patterns to aid detection.