# Gamaredon and UAC-0226

> As of 2026-07-22, Gamaredon and UAC-0226 is a Russia-nexus threat actor tracked by Threadlinqs Intelligence across 1 threat spanning vulnerability. Also known as Gamaredon, Earth Dahu, Armageddon, Primitive Bear.

- **Nation:** Russia
- **Tracked threats:** 1
- **Categories:** VULNERABILITY
- **Also known as:** Gamaredon, Earth Dahu, Armageddon, Primitive Bear, Shuckworm, Trident Ursa, UAC-0226, SHADOW-EARTH-066, RomCom, Storm-0978
- **As of:** 2026-07-22

## Tracked threats

- [Russia-aligned Gamaredon (Earth Dahu) and UAC-0226 (SHADOW-EARTH-066) Exploit Patched WinRAR Path-Traversal CVE-2025-8088 (NTFS ADS) Against Ukrainian Organizations](https://intel.threadlinqs.com/threat/TL-2026-0723) — HIGH

## Related CVEs

1 CVE referenced by tracked Gamaredon and UAC-0226 activity.

- [CVE-2025-8088](https://intel.threadlinqs.com/cve/CVE-2025-8088)

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/Gamaredon%20and%20UAC-0226