ThreatNexus
Nation-state APT intelligence
Dossiers Open app
RussiaAttributedFSB 18th CenterEspionageActive 2013 – 2026

Gamaredon

Also known asPrimitive Bear · Shuckworm · Aqua Blizzard · UAC-0010 · Gamaredon Group · BlueAlpha · ACTINIUM · Trident Ursa · Iron Tilden · Hive0051 · Winterflounder · Blue Otso · Armageddon · SectorC08 · DEV-0157 · UNC530 · NastyShrew

14ATT&CK techniques13Malware & tools1Exploited CVEs4Campaigns3Sectors
Open the interactive dossier Diamond Model Hunt coverage Tradecraft lanes
Share

Summary

Highest-volume FSB unit targeting Ukrainian government and military — thousands of phishing campaigns monthly. FSB officers in occupied Crimea, five publicly identified by Ukraine SSU in 2021.

Attribution

AttributedGovernment attribution: FSB 18th Center

Operates from occupied Crimea, per the SSU

Named by a government: indictment, sanctions designation, joint advisory or official statement.

Sources
  • Security Service of Ukraine (SSU) (Government, 2021-11-04)
    Identified the FSB's 18th Center officers in Crimea behind 5,000+ attacks
  • MITRE ATT&CK (MITRE ATT&CK, 2026-10)
    Records the 2021 Ukrainian government attribution to FSB Center 18
  • ESET Research (Research, 2026-06-25)
    Follows the SSU attribution to the FSB 18th Center

Campaigns 4

CampaignPeriodTargetsSectorsSource
PteroPSDoor deploys Turla's Rezzuar reconnaissance script in Ukraine2026-03 – 2026-06UkraineGovernment, DefenseESET Research (2026-10-28) — cases from March, April and June 2026; sectors follow ESET's Russia-aligned summary
FSB's matryoshka — GammaPhish/GammaWorm chain via WinRAR CVE-2025-80882026-01 – ongoingUkraineGovernment, Military, Critical InfrastructureSekoia (2026), via Infosecurity Magazine (2026-06-01) — chain "seen in January 2026 and still active"; Sekoia's part 3 (2026-06-04) confirms Gamaredon "is still actively operating at the time of this publication" against Ukrainian government, military and critical-infrastructure networks. Part 1, which carries the CVE, does not open here
2025 spearphishing waves incl. WinRAR CVE-2025-8088 (from 2025-09-26)2025-02 – 2025-12UkraineGovernment, MilitaryESET Research (2026-06-25)
Access-sharing with Turla (Kazuar deployment via Ptero* tools)2025-02 – 2025-06UkraineGovernment, DefenseESET Research (2025-09-19)

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 14

Resource Development1T1587.003Digital Certificates
Initial Access1T1566.001Spearphishing Attachment
Execution1T1059.001PowerShell
Persistence2T1547.001Registry Run Keys / Startup FolderT1137.006Add-ins
Stealth5T1564.004NTFS File AttributesT1027.012LNK Icon SmugglingT1620Reflective Code LoadingT1497.001System ChecksT1027.015Compression
Lateral Movement1T1091Replication Through Removable Media
Exfiltration1T1567.002Exfiltration to Cloud Storage
Command and Control2T1105Ingress Tool TransferT1090.003Multi-hop Proxy

Malware and tools 13

NameDescriptionPlatform
Pterodo/PteranodonWorm/BackdoorWindows
GammaLoadLoaderWindows
GammaSteelInfo StealerWindows
QuietSieveInfo StealerWindows
PteroLNKLNK LoaderWindows
PteroPasteDownloader / USB weaponizer / runner (PowerShell)Windows
PteroOddDownloader via Telegra.ph API (PowerShell)Windows
PteroDeePowerShell downloaderWindows
PteroCachePowerShell downloaderWindows
PteroDumDownloader for VBScript payloadsWindows
PteroEffigyDownloader (GoFile-based C2 lookup)Windows
PteroSetupVBScript installer weaponizer (resurrected)Windows
PteroPSDoorBackdoor (PowerShell)Windows

Exploited vulnerabilities 1

CVECVSSDetail
CVE-2025-80888.4RARLAB WinRAR — path traversal via alternate data streams (KEV 2025-08-12)

Highest CVSS first.

Infrastructure patterns

  • C&C behind Cloudflare tunnels and workers, dynamic DNS and PaaS (Clever Cloud, Supabase) (ESET, 2026)
  • Dead-drop resolvers on Telegram, Telegra.ph, Teletype, rentry.co, write.as and Dropbox (ESET, 2026; Sekoia, 2026)
  • PteroPSDoor and PteroVDoor exfiltrate to S3-compatible cloud storage (ESET, 2026)
  • One TLS certificate reused across its infrastructure; VPS hosting outside Russia (MITRE ATT&CK, 2026)

Reporting and advisories 6