Gamaredon Expands Ukraine Attacks with New Malware and Cloud Service Abuse

**Executive summary:** Gamaredon ran at least 35 spear‑phishing campaigns in 2025 against Ukrainian government and military targets, using HTML smuggling and archive/XHTML attachments to deliver HTA downloaders and a growing Ptero* malware family (PowerShell and VBScript loaders), weaponized a patched WinRAR flaw for persistence, and increasingly leveraged legitimate cloud/tunnel services as dead drops and C2 channels to exfiltrate sensitive data.