Russia-backed Gamaredon still ‘most engaged’ hacker group in Ukraine

Gamaredon (Armageddon), a Russia-linked threat actor active since at least 2013 and believed to operate from Crimea on behalf of Russian FSB, has expanded and intensified cyberespionage against Ukraine and some NATO-aligned states. ESET observed over a thousand unique Ukrainian devices targeted in 2022–2023; the group uses spearphishing, malicious Word documents and USB-borne malware, frequently updates and obfuscates tools to maintain access despite being operationally unsophisticated and largely unconcerned with being discovered.