Gamaredon APT Targeting Ukraine with New Variants

**Executive Summary:** Cyble observed a renewed Gamaredon (Russia-linked APT) campaign targeting Ukrainian national security forces via spear-phishing documents that use template-injection to download payloads from attacker-controlled C2 servers; the report provides IoCs (hashes, domains, IP), describes the infection flow and TTPs, and notes limited endpoint detections indicating stealthy operations.