Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset

**ESET Research details Gamaredon’s 2024 activities:** the Russia-aligned APT refocused exclusively on Ukrainian governmental targets, ramped up spearphishing (malicious archives, HTML smuggling, LNK/PowerShell via Cloudflare), introduced six new PowerShell/VBScript tools and upgraded multiple existing malware components for stealth, persistence and lateral movement, and hid much of its C2 behind Cloudflare tunnels, DoH and third-party platforms; a full white paper and IoC set are published for defenders.