Russian APT 'Gamaredon' Upgrades Its Arsenal, Requiring New Defenses
ID: 97e6230d-c74b-5bf2-b195-318baaeb9e16
STIX ID: report--97e6230d-c74b-5bf2-b195-318baaeb9e16
Feed Name: Dark Reading
Threat Score
ESET's report details Gamaredon's 2025 operational upgrades: introduction of multiple PowerShell downloaders (notably 'PteroPaste' which abuses USBs and disguises payloads), enhanced C2 concealment using Microsoft/Cloudflare tunneling and dead-drop sites, exfiltration to legitimate cloud services (Dropbox, S3), and cooperation with Turla to scale attacks primarily against Ukrainian government and military targets.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.