# Gamaredon (Primitive Bear / Shuckworm) APT Profile: Russia-Aligned Espionage Against Ukraine and NATO, Now Exploiting CVE-2025-8088 (WinRAR)

> Gamaredon (aka Primitive Bear, Shuckworm, ACTINIUM, Aqua Blizzard, Armageddon, UAC-0010, Trident Ursa), a Russia-aligned APT active since 2013 and widely attributed to Russia's FSB, continues high-tempo espionage against Ukrainian government, defense, law enforcement, and critical infrastructure, with expansion into NATO member states (Bulgaria, Latvia, Lithuania, Poland). Since September 2025 the group has weaponized CVE-2025-8088, a WinRAR NTFS Alternate-Data-Stream path-traversal flaw, to plant GammaPhish/GammaLoad/GammaWorm/GammaSteel payloads via malicious RAR archives disguised as court summonses or defense-ministry documents.

- **Published:** 2026-07-11T00:00:00Z
- **Last reviewed:** 2026-07-11T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1210
- **ID:** TL-2026-1210
- **Severity:** HIGH (CVSS 8.8)
- **Category:** THREAT_ACTOR
- **Status:** ACTIVE
- **Actor:** Gamaredon (Russia)
- **Detections:** 9 · **IOCs:** 31 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-8088

## Description

Gamaredon (Primitive Bear, Shuckworm, ACTINIUM, Aqua Blizzard, Armageddon, Blue Otso, BlueAlpha, DEV-0157, G0047, IRON TILDEN, SectorC08, Trident Ursa, UAC-0010, UNC530, Winterflounder) is a Russia-aligned advanced persistent threat group active since at least 2013, widely and publicly attributed to Russia's Federal Security Service (FSB). The group is one of the highest-tempo actors targeting Ukraine, having historically hit 1,500+ systems across Ukrainian government, defense, law enforcement, and critical-infrastructure organizations, and has progressively expanded operations against NATO member states Bulgaria, Latvia, Lithuania, and Poland, as well as Russian-speaking populations in Uzbekistan, Kazakhstan, Tajikistan, and Kyrgyzstan.

The group operates a large custom malware suite built around the 'Gamma*' and 'Ptero*' code families: GammaDrop (VBScript dropper), GammaLoad (VBScript/HTA downloader), GammaSteel (PowerShell/modular infostealer), GammaPhish (HTA payload), GammaWorm (USB/LNK self-propagating worm), GammaWipe/GamaWiper (destructive payload variant), PteroGraphin (PowerShell persistence via malicious Excel add-ins, introduced August 2024), PteroLNK (USB weaponizer), PteroTemplate (Word remote-template injection), PteroScreen (screenshot capture), PteroCookie/PteroSteal/PteroScout (credential harvesting and reconnaissance), PteroPSDoor/PteroVDoor (file collection and exfiltration), PteroPShell (raw TCP reverse shell), and PteroClone (rclone-based exfiltration to cloud storage). The group also fields Android spyware (BoneSpy, PlainGnome) and leverages third-party/open-source tooling including the Remcos commercial RAT, ReVBShell, rclone, cloudflared (Cloudflare Tunnel client, abused from September 2024), and ngrok.

Since at least September 2025, Gamaredon (tracked in this specific WinRAR campaign by some vendors as 'Earth Dahu') has incorporated CVE-2025-8088 — a WinRAR NTFS Alternate Data Stream path-traversal vulnerability affecting versions up to 7.12 — into its intrusion chain. Malicious RAR archives are distributed via spear-phishing, disguised as court summonses, administrative notices, or Ministry of Defense documents. The archive's ADS stream name embeds directory-traversal sequences (e.g. redundant '\Programs\..\Programs\..\Programs\' segments — a Gamaredon-specific quirk that defeats WinRAR's traversal mitigations) so that, on extraction with a vulnerable WinRAR build, a hidden payload is silently written into the victim's Startup folder while a decoy PDF is displayed. This launches an HTA-to-VBScript infection chain: GammaPhish (HTA) retrieves GammaLoad (VBScript downloader), which performs host fingerprinting and registry-based configuration via dead-drop resolvers (DDRs — Telegram channels, telegra.ph, teletype.in) before fetching further VBScript payloads. GammaWorm then establishes scheduled-task persistence and self-propagates via concealed directories on network shares and removable USB media using malicious LNK files; GammaSteel exfiltrates documents matching a hardcoded extension list (.doc, .docx, .xls, .xlsx, .ppt, .pptx, .vsd, .vsdx, .rtf, .odt, .txt, .pdf) plus Signal/Telegram/browser data stores, staged and exfiltrated to attacker infrastructure including AWS S3 buckets and rclone-to-MEGA cloud sync. CVE-2025-8088 exploitation by Gamaredon and other Ukraine-focused intrusion sets continued to produce new exploit samples at least into April 2026, well after WinRAR 7.13 (released 30 July 2025) patched the flaw — underscoring the persistent unpatched-software exposure in Ukrainian environments.

Gamaredon's C2 infrastructure follows a consistent pattern of 'twin' domain registrations (e.g. kosoyed[.]ru + kosoyed[.]online) registered simultaneously through REG.RU using consistent Cloudflare nameservers, backed by VPS providers DigitalOcean, MivoCloud, TimeWeb, and Global Internet Solutions LLC, plus abuse of Cloudflare Workers (*.workers.dev) for staged delivery/beaconing, dynamic DNS (ddnsking[.]com, ddns[.]net), and periodic hijacking of legitimate compromised domains via registrar-account compromise (e.g. joymobile.com[.]ua). GammaLoad implements automatic C2 fallback: if the primary Cloudflare Workers channel returns a response under 75 characters or an HTTP 404, the malware switches to a hardcoded .ru fallback domain.

Gamaredon also functions as an access broker for other Russian state-aligned operators: in January 2025 it breached four machines in Ukraine and handed initial access to the Turla APT, demonstrating coordination between distinct FSB/SVR-aligned units for staged intrusions. On 26 February 2025, the group compromised a Western military mission using an infected removable drive, and in March 2025 it ran a Russian troop-movement lure campaign distributing malicious LNK files.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1583.001 Domains
- T1583.003 Virtual Private Server
- T1583.006 Web Services
- T1584.001 Domains
- T1586.002 Email Accounts
- T1587.001 Malware
- T1588.002 Tool
- T1091 Replication Through Removable Media
- T1566.001 Spearphishing Attachment
- T1203 Exploitation for Client Execution
- T1047 Windows Management Instrumentation
- T1059.001 PowerShell
- T1059.007 JavaScript
- T1106 Native API
- T1204.002 Malicious File
- T1037.001 Logon Script (Windows)
- T1053.005 Scheduled Task
- T1137.001 Office Template Macros
- T1547.001 Registry Run Keys / Startup Folder
- T1027.006 HTML Smuggling
- T1027.011 Fileless Storage
- T1027.013 Encrypted/Encoded File
- T1036.004 Masquerade Task or Service
- T1036.007 Double File Extension
- T1112 Modify Registry
- T1218.005 Mshta
- T1222 File and Directory Permissions Modification
- T1480.001 Environmental Keying
- T1539 Steal Web Session Cookie
- T1552.002 Credentials in Registry
- T1555.003 Credentials from Web Browsers
- T1518.001 Security Software Discovery
- T1080 Taint Shared Content
- T1091 Replication Through Removable Media
- T1005 Data from Local System
- T1025 Data from Removable Media
- T1039 Data from Network Shared Drive
- T1074.001 Local Data Staging
- T1113 Screen Capture

## Sources

- [Gamaredon / Primitive Bear APT Profile and MITRE ATT&CK Breakdown](https://www.picussecurity.com/resource/blog/gamaredon-primitive-bear-apt-profile-and-mitre-attck-breakdown)
- [Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open](https://www.trendmicro.com/en_us/research/26/f/old-winrar-flaw-fuels-attacks-on-ukraine.html)
- [Google Warns of Active Exploitation of WinRAR Vulnerability CVE-2025-8088](https://thehackernews.com/2026/01/google-warns-of-active-exploitation-of.html)
- [Diverse Threat Actors Exploiting Critical WinRAR Vulnerability CVE-2025-8088](https://cloud.google.com/blog/topics/threat-intelligence/exploiting-critical-winrar-vulnerability)
- [CVE-2025-8088 Detail](https://www.tenable.com/cve/CVE-2025-8088)
- [WinRAR Flaw Exploited by Russia-Aligned Groups to Deploy Stealers in Ukraine](https://thehackernews.com/2026/06/winrar-flaw-exploited-by-russia-aligned.html)
- [Gamaredon Exploits WinRAR to Deliver GammaWorm and GammaSteel Against Ukraine](https://thehackernews.com/2026/06/gamaredon-exploits-winrar-to-deliver.html)
- [Russian Hackers Gamaredon Weaponize WinRAR Flaw for First Destructive Strike](https://www.techtimes.com/articles/319374/20260630/russian-hackers-gamaredon-weaponize-winrar-flaw-first-destructive-strike.htm)
- [Gamaredon Uses WinRAR Vulnerability to Launch Modular Spy Campaign on Ukrainian Targets](https://securityaffairs.com/193112/intelligence/gamaredon-uses-winrar-vulnerability-to-launch-modular-spy-campaign-on-ukrainian-targets.html)
- [CVE-2025-8088 Detail - NVD](https://nvd.nist.gov/vuln/detail/cve-2025-8088)
- [Gamaredon Exploits WinRAR Path Traversal (CVE-2025-8088) to Deploy Modular Malware Chain Against Ukrainian Targets](https://techjacksolutions.com/scc-intel/gamaredon-exploits-winrar-path-traversal-cve-2025-8088-to-deploy-modular-malware-chain-against-ukrainian-targets/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1210