Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The latest detailed public reporting located describes Gamaredon targeting Ukrainian government and military institutions throughout 2025—not a newly disclosed attack on a named official tied to a specific rise in tensions. ESET Research published its account on June 25, 2026, reporting expanded spear-phishing, six new PowerShell tools, and greater reliance on cloud storage to remove stolen files. Attribution to a Russian FSB center is an assessment by Ukraine’s Security Service, as reported by ESET, rather than an independently established finding in the report.
What the latest reporting says
ESET Research’s June 25, 2026 report covers Gamaredon’s activity during 2025. ESET says the group focused exclusively on Ukrainian government and military institutions, seeking sensitive information that could support Russian interests in the war. That is ESET’s assessment of the activity and its purpose; the report does not provide a named victim list or establish a discrete attack connected to a particular escalation in Russian tensions. ESET’s 2025 activity report
ESET reports that Ukraine’s Security Service (SSU) attributes Gamaredon to the 18th Center of Information Security of Russia’s Federal Security Service (FSB), and that the group is believed to operate from occupied Crimea. Those claims should be understood as an attributed security-service assessment. ESET also says the group took a short operational break in January 2025, worked on tools during the first half of the year, and ran larger and more frequent spear-phishing campaigns in the second half. ESET’s attribution and campaign account
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →How Gamaredon’s reported 2025 operations changed
More phishing and new PowerShell tools
ESET says it identified six newly introduced PowerShell tools in 2025: PteroDee, PteroCache, PteroDum, PteroOdd, PteroPaste, and PteroEffigy. PteroPaste combined a downloader, a USB-drive weaponizer, and a runner used for persistence and orchestration. ESET also observed the return of PteroSetup, a VBScript weaponizer first seen in 2021. These are tools in ESET’s 2025 account, not a complete inventory of the group’s capabilities.
#1 Best Overall
The campaigns used spear-phishing and custom weaponizers to spread through USB drives, mapped network drives, and software installers. ESET describes the group as using legitimate online services to retrieve command-and-control (C&C) information or deliver payloads. These services can make malicious infrastructure harder to distinguish from ordinary web traffic; their use does not mean the legitimate platforms themselves are responsible for the activity. ESET’s tools and infrastructure findings
Cloud storage became the primary reported exfiltration route
ESET reports that Gamaredon upgraded its file stealers to send stolen data to cloud storage, which became the group’s primary exfiltration method in 2025. The services named in the report are Wasabi, Tebi, and Intercolo. The report does not provide a victim count or quantify how much data was removed.
Holiday timing is an inference, not proof of employment status
ESET researcher Zoltán Rusnák said updates were often made ahead of major Russian and Crimean holidays, with none observed during or immediately after them. ESET said this timing “further suggest[s]” that operators were “probably government-affiliated employees.” The qualification matters: the observed schedule supports an inference, not a confirmed description of the operators’ employment.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →How the 2025 activity compares with the previous year
ESET’s July 2, 2025 report describes activity during 2024. It also records intensified spear-phishing in the second half of that year, but details different delivery patterns and infrastructure. The two reports are snapshots of separate activity periods, not a guarantee that every tactic continued unchanged.
Rank #3
| Area | 2024 activity, reported July 2, 2025 | 2025 activity, reported June 25, 2026 |
|---|---|---|
| Targets | Ukraine; the report describes campaigns against the country. | Government and military institutions in Ukraine; ESET says the focus was exclusively on Ukraine. |
| Initial access and delivery | Malicious RAR, ZIP, or 7z archives and XHTML files that led to HTA or LNK files and VBScript downloaders. | More frequent and larger spear-phishing campaigns in the second half of the year, alongside custom weaponizers spreading through USB drives, mapped network drives, and software installers. |
| Tools | An evolved toolset, including VBScript-based delivery described in ESET’s account. | Six newly introduced PowerShell tools, plus the revived PteroSetup VBScript weaponizer. |
| Infrastructure concealment and delivery | Telegram, Telegraph, Codeberg, Dropbox, and Cloudflare tunnels were among the services and infrastructure ESET described. | Third-party tunnels, workers, dynamic DNS, and platform-as-a-service, as well as legitimate messaging, social, blog, and paste services used as “dead drops” to resolve C&C servers or distribute payloads. |
| Data exfiltration | The July 2025 report’s summary does not establish a comparable primary exfiltration method. | Cloud storage services Wasabi, Tebi, and Intercolo became the primary method, according to ESET. |
Sources: ESET’s report on 2024 activity and ESET’s report on 2025 activity.
What earlier Ukrainian advisories add
Ukrainian government reporting has described Gamaredon under the designation UAC-0010, also called Armageddon. A February 2023 advisory from the State Cyber Protection Centre described multi-step download activity and GammaLoad and GammaSteel spyware. An August 2023 National Security and Defense Council summary reported increased activity ahead of Ukraine’s counteroffensive, use of compromised legitimate documents as lures, and Telegram and Telegraph use. These are historical snapshots; they do not establish present campaign volumes or current tactics. State Cyber Protection Centre advisory, February 1, 2023 · National Security and Defense Council summary, August 31, 2023
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What officials and other readers can do about messaging-account attacks
Separately from its Gamaredon reporting, a June 25, 2026 announcement by Ukraine’s Security Service and the FBI described Russian attacks on messaging accounts belonging to officials, military personnel, politicians, and activists across Ukraine, Europe, and the United States. The announcement is not specifically attributed to Gamaredon. Its account-safety advice is broadly useful:
- Review active sessions and end any you do not recognize.
- Enable two-factor authentication.
- Keep login codes and recovery keys private; do not give them to someone who contacts you unexpectedly.
- Be cautious with suspicious links, files, and QR codes, including messages that appear to come from a known contact.
SSU and FBI account-security announcement, June 25, 2026
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
