Threat actorRussiaTracked since 2026-06

Gamaredon and UAC-0226

Also known as:GamaredonEarth DahuArmageddonPrimitive BearShuckwormTrident UrsaUAC-0226SHADOW-EARTH-066RomComStorm-0978

As of 2026-07-22, Gamaredon and UAC-0226 is a Russia-nexus threat actor tracked by Threadlinqs Intelligence across 1 threat spanning vulnerability. Also known as Gamaredon, Earth Dahu, Armageddon, Primitive Bear.

Tracked threats: 11 high
First seen: 2026-062026-06-09
Last seen: 2026-062026-06-09
ATT&CK techniques: —No mapped techniques yet
Related CVEs: 1Referenced by its activity
Attribution: RussiaNation or origin

Nation: Russia · 1 tracked threat(s) · Categories: VULNERABILITY

Activity timeline

Gamaredon and UAC-0226 appears in 1 tracked threat between 2026-06-09 and 2026-06-09.

Tracked threats

Russia-aligned Gamaredon (Earth Dahu) and UAC-0226 (SHADOW-EARTH-066) Exploit Patched WinRAR Path-Traversal CVE-2025-8088 (NTFS ADS) Against Ukrainian OrganizationsHIGH2026-06-09

Related CVEs

1 CVE referenced by tracked Gamaredon and UAC-0226 activity

CVE-2025-8088