Skip to content
Gamaredon Group Targets Ukrainian Systems in Ongoing Espionage Campaign

Gamaredon Group Targets Ukrainian Systems in Ongoing Espionage Campaign

First seen 29 Oct 2026, 00:37 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 29, 2026 at 02:12 UTC
  • •Gamaredon has targeted over 1,500 Ukrainian government systems since 2013.
  • •The group acts as an access broker for other Russian APTs, including Turla.
  • •Gamaredon employs various tools, including Android spyware and obfuscated PowerShell scripts.

Gamaredon, a Russia-aligned APT group, has been active since 2013, primarily targeting Ukrainian government and military systems. The group has attempted to infect over 1,500 Ukrainian government systems and has conducted around 5,000 attacks by late 2021. Gamaredon is known for its cyber espionage and data theft tactics, focusing on critical infrastructure and law enforcement. It has also targeted NATO members, including Bulgaria, Latvia, Lithuania, and Poland. The group employs various tools, including Android spyware families like BoneSpy and PlainGnome, and has acted as an access broker for other Russian APTs, such as Turla. The group uses multiple domains and VPS hosting for command and control operations, and its tactics include scanning for sensitive documents and maintaining persistence through registry modifications. The current operational status of Gamaredon remains active.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2021-11-01
Ukrainian government attributes Gamaredon to FSB
The Ukrainian government publicly attributed Gamaredon Group to Russia’s Federal Security Service, supported by independent researchers.
attack.mitre.org
2024-05-26
Public exploit for CVE-2025-8088 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub
Recent
Gamaredon continues active operations
Gamaredon is reported to be actively conducting espionage campaigns against Ukrainian and NATO member systems.
www.picussecurity.com

More articles in this cluster (2)

Following this threat?

Track Gamaredon, BoneSpy and CVE-2025-8088 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (66)

1 / 4

Common questions

What types of organizations are targeted by Gamaredon?
Gamaredon primarily targets Ukrainian government, military, law enforcement, and critical infrastructure organizations.
How does Gamaredon operate?
Gamaredon uses various tools for cyber espionage, including Android spyware and PowerShell scripts, and acts as an access broker for other APTs.
What is the current status of Gamaredon's operations?
Gamaredon remains active, continuing its espionage campaigns against Ukrainian and NATO member systems.