Gamaredon Expands Ukraine Attacks with PteroSetup Revival and Cloud Service Abuse, Exploiting WinRAR Flaw CVE-2025-8088

Gamaredon Expands Ukraine Attacks with PteroSetup Revival (TL-2026-1216), also tracked as Ptero malware family, is a high-severity software vulnerability scored CVSS 8.8, first published 2026-06-29 and last reviewed 2026-08-26. It is attributed to Gamaredon (Russia) with high confidence, affects RARLAB WinRAR (Windows), references 1 CVE (CVE-2025-8088), maps to 30 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 35 indicators of compromise.

Key facts for TL-2026-1216

Threat ID
TL-2026-1216
Also known as
Ptero malware family, PteroSetup revival, Shuckworm 2025 campaigns
Severity
HIGH
CVSS
8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-06-29
Last reviewed
2026-08-26
Attribution
Gamaredon
Attribution confidence
HIGH
Nation-state nexus
Russia
Motivation
ESPIONAGE
Target sectors
government administration, military, defense
Target regions
ukraine, Crimea
Detection rules
9
Indicators of compromise
35
Updates
2026-08-26 · revalidated 1× · latest source

Malware and tooling in Gamaredon Expands Ukraine Attacks with PteroSetup Revival

Malware and tooling: PteroBox, PteroCache, PteroDee, PteroDum, PteroEffigy, PteroLNK, PteroOdd, PteroPSDoor, PteroPaste, PteroSand, PteroSetup, PteroVDoor

Russian APT group Gamaredon ran 35 spear-phishing campaigns against Ukrainian governmental and military institutions throughout 2025, reviving the dormant PteroSetup VBScript weaponizer and expanding its "Ptero" malware family (PteroSand, PteroLNK, PteroPaste, PteroDee, PteroCache, PteroDum, PteroOdd, PteroEffigy). Some attacks weaponized a now-patched WinRAR path traversal flaw (CVE-2025-8088) to drop a malicious HTA downloader into the Windows Startup folder for persistence, alongside spear-phishing, HTML smuggling, malicious LNK-based lateral movement, and abuse of legitimate cloud/paste services (Telegra.ph, Teletype, Rentry.co, Write.as, Dropbox, GoFile, DEV Community, Mastodon, Lesma, Nopaste.net, Paste.ee, Wasabi, Tebi, Intercolo) for exfiltration and dead-drop resolving.

How Gamaredon Expands Ukraine Attacks with PteroSetup Revival works

ESET Research documented a comprehensive 2025 retrospective of Gamaredon (aka Armageddon, Shuckworm, UAC-0010, Trident Ursa, Iron Tilden), a Russia-aligned APT attributed by Ukraine's Security Service (SSU) to the 18th Center of Information Security of Russia's FSB, believed to operate out of occupied Crimea. Across 35 distinct spear-phishing campaigns during 2025, the group exclusively targeted Ukrainian governmental and military institutions in pursuit of sustained cyberespionage and data exfiltration supporting Russian interests in the war against Ukraine.

After an operational pause in January 2025 the group spent Q1 building new delivery tooling, releasing five of six brand-new PowerShell/VBScript tools (PteroDee, PteroCache, PteroDum, PteroOdd, PteroEffigy) that joined and updated the existing Ptero malware family (PteroLNK, PteroPSLoad, PteroPSDoor, PteroVDoor, PteroBox, PteroSand, PteroPaste). Notably, Gamaredon resurrected PteroSetup, a VBScript weaponizer first seen in January 2021 that had been dormant for years; the revived version scans fixed, removable, and network drives for installer-like executables and replaces them with malicious self-extracting 7z SFX archives bundling the legitimate installer alongside a malicious VBScript downloader, so that execution launches both the expected application and the malicious payload.

The group's second half of 2025 saw a marked escalation in campaign frequency and scale, delivered via malicious archive attachments and XHTML files using HTML smuggling (T1027.006), spear-phishing attachments (T1566.002), and malicious LNK files enabling lateral movement across USB drives and mapped network shares (T1091/T1570). Beginning September 26, 2025, Gamaredon began abusing CVE-2025-8088 -- a critical path-traversal vulnerability in the Windows build of WinRAR (patched in version 7.13, released July 30, 2025) -- to smuggle a malicious HTA downloader directly into the victim's Startup folder via crafted Alternate Data Stream (ADS) paths inside RAR archives, achieving persistence through automatic execution at next logon (T1547.001).

A defining feature of Gamaredon's 2025 tradecraft was heavy reliance on legitimate third-party cloud and developer infrastructure to hide back-end C2 and complicate takedown/attribution: Cloudflare Tunnels (trycloudflare.com) and Workers (workers.dev), Microsoft DevTunnels (devtunnels.ms), Loophole (loophole.site), No-IP DDNS, Clever Cloud (cleverapps.io), and Supabase (supabase.co) were used for C2 relay, while Telegram/Telegra.ph, Teletype, Rentry.co, Write.as, Dropbox, GoFile, DEV Community, Mastodon, Lesma, Nopaste.net, and Paste.ee served as dead-drop resolvers for payload and configuration retrieval (PteroOdd fetches payloads via the Telegra.ph API; PteroEffigy resolves C2 details via GoFile). Data exfiltration progressively shifted to S3-compatible object storage providers -- Wasabi, then Tebi, then Intercolo (established as the primary exfiltration destination by December 2025) -- alongside continued use of Dropbox via PteroBox and rclone (T1537).

ESET also documented early-2025 operational collaboration between Gamaredon and the Turla APT group (also FSB-linked), with the PteroOdd tool specifically associated with the joint activity. ESET researchers observed that tool-update cadence paused around major Russian and Crimean holidays, consistent with operators being government-affiliated employees working standard schedules rather than a criminal enterprise.

CVE-2025-8088 itself is a high-severity (CVSS 3.1: 8.8) path traversal vulnerability in RARLAB WinRAR (CWE-35) affecting the Windows version of WinRAR 7.12 and earlier plus the UnRAR.dll/UnRAR source components (non-Windows platforms unaffected); dtSearch versions prior to 2023.01, which bundles vulnerable UnRAR code, are also affected. Crafted archives abuse ADS path traversal (..\ sequences) to write attacker-controlled files outside the intended extraction directory, into locations such as %TEMP%, %LOCALAPPDATA%, and the Startup folder. The flaw was discovered by ESET researchers (Cherepanov, Košinár, Strýček) after observing in-the-wild exploitation by RomCom and other actors as early as July 18, 2025, patched by RARLAB on July 30, 2025 (WinRAR 7.13), and added to the CISA Known Exploited Vulnerabilities (KEV) catalog on August 12, 2025 with a remediation due date of September 2, 2025. Multiple nation-state (Russia- and China-linked) and financially motivated threat actors, including Gamaredon, continued exploiting this n-day well after patch availability due to WinRAR's lack of auto-update and slow enterprise patch adoption.

MITRE ATT&CK techniques used in TL-2026-1216

Collection

T1005 Data from Local System; T1119 Automated Collection

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1211 Exploitation for Stealth; T1218.005 System Binary Proxy Execution; T1620 Reflective Code Loading

Execution

T1059 Command and Scripting Interpreter; T1204 User Execution

Command and Control

T1071 Application Layer Protocol; T1090 Proxy; T1102 Web Service; T1102.002 Web Service; T1105 Ingress Tool Transfer; T1572 Protocol Tunneling

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery

Initial Access

T1091 Replication Through Removable Media; T1566 Phishing

Lateral Movement

T1091 Replication Through Removable Media; T1570 Lateral Tool Transfer

Credential Access

T1212 Exploitation for Credential Access

Exfiltration

T1537 Transfer Data to Cloud Account; T1567 Exfiltration Over Web Service

Persistence

T1547 Boot or Logon Autostart Execution

Impact

T1565 Data Manipulation

Resource Development

T1583 Acquire Infrastructure; T1586.002 Compromise Accounts; T1587 Develop Capabilities

Reconnaissance

T1589 Gather Victim Identity Information

Affected products and versions in Gamaredon Expands Ukraine Attacks with PteroSetup Revival

  • RARLAB — WinRAR (Windows)
    Vulnerable versions: <= 7.12
    Fixed in: 7.13
  • RARLAB — UnRAR.dll / UnRAR source code
    Vulnerable versions: <= 7.12
    Fixed in: 7.13
  • dtSearch — dtSearch Engine
    Vulnerable versions: < 2023.01
    Fixed in: 2023.01

Remediation for Gamaredon Expands Ukraine Attacks with PteroSetup Revival

Patches

  • WinRAR 7.13 (released July 30, 2025) fixes CVE-2025-8088 in the desktop application, portable UnRAR source code, and UnRAR.dll
  • dtSearch 2023.01 or later addresses the bundled vulnerable UnRAR component

Immediate actions

  • Update WinRAR to version 7.13 or later on all Windows hosts immediately
  • Audit Windows Startup folders for unauthorized HTA, VBScript, or LNK files
  • Block or monitor execution of mshta.exe, wscript.exe, and cscript.exe launched from Startup folders and user-writable directories
  • Restrict or monitor egress to known dead-drop and tunneling services abused by Gamaredon (trycloudflare.com, workers.dev, devtunnels.ms, loophole.site, telegra.ph, rentry.co, write.as, gofile.io, paste.ee, wasabisys.com, tebi.io) where not business-required
  • Disable AutoRun/AutoPlay for removable media and enforce USB device control policies to reduce PteroLNK/PteroPaste lateral movement risk
  • Hunt for self-extracting 7z SFX archives masquerading as legitimate installers on shared/network drives

Workarounds

  • If patching is not immediately possible, avoid opening RAR/archive attachments from untrusted or unsolicited sources
  • Extract archives with alternative tools not affected by the ADS path-traversal flaw, or extract to sandboxed/isolated environments
  • Apply Windows Attack Surface Reduction rules to block Office/archive-tool child process execution of scripting engines

Longer-term hardening

  • Deploy application allowlisting to prevent unsigned HTA/VBScript/LNK execution
  • Implement network segmentation between government/military endpoints and general user networks
  • Establish continuous patch management for third-party archive utilities and other commonly-exploited desktop software
  • Deploy EDR with behavioral detection for in-memory PowerShell execution and living-off-the-land techniques characteristic of PteroDee/PteroCache
  • Conduct regular threat hunting exercises against Gamaredon TTPs given persistent, sustained targeting of Ukrainian institutions
  • Restrict outbound access to consumer cloud storage and paste services from sensitive government network segments

CVEs associated with Gamaredon Expands Ukraine Attacks with PteroSetup Revival

CVE-2025-8088

Weaknesses (CWE) in Gamaredon Expands Ukraine Attacks with PteroSetup Revival

CWE-35, CWE-22

Timeline of Gamaredon Expands Ukraine Attacks with PteroSetup Revival

  • PteroSetup VBScript weaponizer first detected by ESET, later going dormant for years before its 2025 revival.
  • Gamaredon takes an operational break in January 2025 while developing new tooling.
  • Early 2025 collaboration between Gamaredon and Turla APT documented by ESET, involving the PteroOdd tool.
  • Five of six new PowerShell/VBScript tools (PteroDee, PteroCache, PteroDum, PteroOdd, PteroEffigy) deployed during Q1 2025.
  • Gamaredon begins integrating Cloudflare Workers into its C2 infrastructure.
  • Gamaredon adopts Microsoft DevTunnels and Loophole tunneling services for hiding C2 back-end infrastructure.
  • In-the-wild exploitation of CVE-2025-8088 WinRAR path traversal flaw begins, initially by RomCom and other actors (per ESET/Google TAG reporting).
  • RARLAB releases WinRAR 7.13, patching CVE-2025-8088 across the desktop app, portable UnRAR source, and UnRAR.dll.
  • CISA adds CVE-2025-8088 to its Known Exploited Vulnerabilities catalog with a remediation due date of September 2, 2025.
  • Gamaredon begins abusing CVE-2025-8088 to drop malicious HTA downloaders into victims' Windows Startup folders for persistence.
  • Second half of 2025 sees a marked escalation in the frequency and scale of Gamaredon spear-phishing campaigns against Ukrainian government and military targets.
  • Intercolo (de-fra.i3storage.com) established as Gamaredon's primary data exfiltration destination, following a Wasabi-to-Tebi-to-Intercolo progression.
  • Earth Dahu's spear-phishing sending domain astrocafe[.]com is registered via reg.ru.
  • ESET tallies 35 distinct Gamaredon spear-phishing campaigns against Ukrainian governmental and military institutions across 2025.
  • Trend Micro observes the latest Earth Dahu RAR archive timestamp, showing Gamaredon's CVE-2025-8088 exploitation continuing into April 2026, nearly a year after the WinRAR patch.
  • Trend Micro publishes "Old WinRAR Flaw Fuels Attacks on Ukraine," documenting continued Earth Dahu (Gamaredon) exploitation of CVE-2025-8088 alongside a separate, unrelated SHADOW-EARTH-066 (UAC-0226) intrusion set exploiting the same flaw.
  • ESET Research publishes "Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances," detailed in coverage by The Hacker News.

Update history for TL-2026-1216

Sources cited for Gamaredon Expands Ukraine Attacks with PteroSetup Revival

Threats related to Gamaredon Expands Ukraine Attacks with PteroSetup Revival

Detection coverage for TL-2026-1216

As of 2026-08-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1216 across Splunk SPL, Microsoft KQL and Sigma, covering 35 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats