Gamaredon Group 2025 Evolution: New PowerShell Toolset and Collaboration

Throughout 2025, the Gamaredon group (attributed to Russia's FSB 18th Center) maintained a high operational tempo exclusively targeting Ukrainian government and military entities. The group evolved its tradecraft by shifting from direct C2 infrastructure to a complex multi-layered approach involving Cloudflare workers, devtunnels, and dead drop resolvers on legitimate platforms like Telegram, Dropbox, and Mastodon. This evolution complicates traditional network blocking and analysis efforts.

Technically, Gamaredon introduced a new suite of PowerShell-based downloaders (PteroDee, PteroCache, PteroDum, PteroOdd, PteroEffigy, and PteroPaste) and weaponized a WinRAR path traversal vulnerability (CVE-2025-8088) for persistence. Notable findings include observed collaboration with Turla, where Gamaredon provided initial access for Turla’s Kazuar framework, and a strategic move toward S3-compatible cloud storage (Wasabi, Tebi, Intercolo) for data exfiltration.

As the conflict in Ukraine persists, Gamaredon remains a highly adaptive threat actor. Their ability to blend malicious traffic with legitimate third-party services like Cloudflare and various PaaS offerings requires defenders to shift toward identity-aware microsegmentation and behavioral analysis of application workflows rather than relying solely on static IP/domain indicators.