Gamaredon
Nation-state Espionage Russia Active
Aliases: Primitive Bear · Aqua Blizzard · Shuckworm · Armageddon · Trident Ursa
- Mentions
- 3
- First seen
- 02 Jun 2026
- Last seen
- 29 Jun 2026
Relevant to you · Relevant
- Threat focus:
- espionage / apt
- Sector / region:
- DACH
Origin
Russia — Russian FSB
Profile
Gamaredon is a Russian APT group that is expanding its attacks on Ukraine. Recent reports indicate the use of new malware and cloud service abuse. The group has upgraded its arsenal and exploits vulnerabilities such as WinRAR to deliver malware like GammaWorm and GammaSteel.
Affected vendors
Rarlab
Targeted regions
Europe
Targeted countries
Ukraine
Associated malware / tools
GammaWormGammaSteel
Linked CVEs
- CVE-2025-8088 KEV CVSS 8.8 EPSS 9%
Related actors
Share a CVE, technique or malware with this actor.