# Gamaredon Expands Ukraine Attacks with PteroSetup Revival and Cloud Service Abuse, Exploiting WinRAR Flaw CVE-2025-8088

> Russian APT group Gamaredon ran 35 spear-phishing campaigns against Ukrainian governmental and military institutions throughout 2025, reviving the dormant PteroSetup VBScript weaponizer and expanding its "Ptero" malware family (PteroSand, PteroLNK, PteroPaste, PteroDee, PteroCache, PteroDum, PteroOdd, PteroEffigy). Some attacks weaponized a now-patched WinRAR path traversal flaw (CVE-2025-8088) to drop a malicious HTA downloader into the Windows Startup folder for persistence, alongside spear-phishing, HTML smuggling, malicious LNK-based lateral movement, and abuse of legitimate cloud/paste services (Telegra.ph, Teletype, Rentry.co, Write.as, Dropbox, GoFile, DEV Community, Mastodon, Lesma, Nopaste.net, Paste.ee, Wasabi, Tebi, Intercolo) for exfiltration and dead-drop resolving.

- **Published:** 2026-06-29T00:00:00Z
- **Last reviewed:** 2026-08-26T20:54:40.209Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1216
- **ID:** TL-2026-1216
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** Gamaredon (Russia)
- **Detections:** 9 · **IOCs:** 35 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-8088

## Description

ESET Research documented a comprehensive 2025 retrospective of Gamaredon (aka Armageddon, Shuckworm, UAC-0010, Trident Ursa, Iron Tilden), a Russia-aligned APT attributed by Ukraine's Security Service (SSU) to the 18th Center of Information Security of Russia's FSB, believed to operate out of occupied Crimea. Across 35 distinct spear-phishing campaigns during 2025, the group exclusively targeted Ukrainian governmental and military institutions in pursuit of sustained cyberespionage and data exfiltration supporting Russian interests in the war against Ukraine.

After an operational pause in January 2025 the group spent Q1 building new delivery tooling, releasing five of six brand-new PowerShell/VBScript tools (PteroDee, PteroCache, PteroDum, PteroOdd, PteroEffigy) that joined and updated the existing Ptero malware family (PteroLNK, PteroPSLoad, PteroPSDoor, PteroVDoor, PteroBox, PteroSand, PteroPaste). Notably, Gamaredon resurrected PteroSetup, a VBScript weaponizer first seen in January 2021 that had been dormant for years; the revived version scans fixed, removable, and network drives for installer-like executables and replaces them with malicious self-extracting 7z SFX archives bundling the legitimate installer alongside a malicious VBScript downloader, so that execution launches both the expected application and the malicious payload.

The group's second half of 2025 saw a marked escalation in campaign frequency and scale, delivered via malicious archive attachments and XHTML files using HTML smuggling (T1027.006), spear-phishing attachments (T1566.002), and malicious LNK files enabling lateral movement across USB drives and mapped network shares (T1091/T1570). Beginning September 26, 2025, Gamaredon began abusing CVE-2025-8088 -- a critical path-traversal vulnerability in the Windows build of WinRAR (patched in version 7.13, released July 30, 2025) -- to smuggle a malicious HTA downloader directly into the victim's Startup folder via crafted Alternate Data Stream (ADS) paths inside RAR archives, achieving persistence through automatic execution at next logon (T1547.001).

A defining feature of Gamaredon's 2025 tradecraft was heavy reliance on legitimate third-party cloud and developer infrastructure to hide back-end C2 and complicate takedown/attribution: Cloudflare Tunnels (trycloudflare.com) and Workers (workers.dev), Microsoft DevTunnels (devtunnels.ms), Loophole (loophole.site), No-IP DDNS, Clever Cloud (cleverapps.io), and Supabase (supabase.co) were used for C2 relay, while Telegram/Telegra.ph, Teletype, Rentry.co, Write.as, Dropbox, GoFile, DEV Community, Mastodon, Lesma, Nopaste.net, and Paste.ee served as dead-drop resolvers for payload and configuration retrieval (PteroOdd fetches payloads via the Telegra.ph API; PteroEffigy resolves C2 details via GoFile). Data exfiltration progressively shifted to S3-compatible object storage providers -- Wasabi, then Tebi, then Intercolo (established as the primary exfiltration destination by December 2025) -- alongside continued use of Dropbox via PteroBox and rclone (T1537).

ESET also documented early-2025 operational collaboration between Gamaredon and the Turla APT group (also FSB-linked), with the PteroOdd tool specifically associated with the joint activity. ESET researchers observed that tool-update cadence paused around major Russian and Crimean holidays, consistent with operators being government-affiliated employees working standard schedules rather than a criminal enterprise.

CVE-2025-8088 itself is a high-severity (CVSS 3.1: 8.8) path traversal vulnerability in RARLAB WinRAR (CWE-35) affecting the Windows version of WinRAR 7.12 and earlier plus the UnRAR.dll/UnRAR source components (non-Windows platforms unaffected); dtSearch versions prior to 2023.01, which bundles vulnerable UnRAR code, are also affected. Crafted archives abuse ADS path traversal (..\ sequences) to write attacker-controlled files outside the intended extraction directory, into locations such as %TEMP%, %LOCALAPPDATA%, and the Startup folder. The flaw was discovered by ESET researchers (Cherepanov, Košinár, Strýček) after observing in-the-wild exploitation by RomCom and other actors as early as July 18, 2025, patched by RARLAB on July 30, 2025 (WinRAR 7.13), and added to the CISA Known Exploited Vulnerabilities (KEV) catalog on August 12, 2025 with a remediation due date of September 2, 2025. Multiple nation-state (Russia- and China-linked) and financially motivated threat actors, including Gamaredon, continued exploiting this n-day well after patch availability due to WinRAR's lack of auto-update and slow enterprise patch adoption.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1566 Phishing
- T1091 Replication Through Removable Media
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1547 Boot or Logon Autostart Execution
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1140 Deobfuscate/Decode Files or Information
- T1211 Exploitation for Stealth
- T1620 Reflective Code Loading
- T1212 Exploitation for Credential Access
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1570 Lateral Tool Transfer
- T1091 Replication Through Removable Media
- T1005 Data from Local System
- T1119 Automated Collection
- T1071 Application Layer Protocol
- T1102 Web Service
- T1090 Proxy
- T1572 Protocol Tunneling
- T1105 Ingress Tool Transfer
- T1567 Exfiltration Over Web Service
- T1537 Transfer Data to Cloud Account
- T1565 Data Manipulation
- T1218.005 System Binary Proxy Execution
- T1586.002 Compromise Accounts
- T1102.002 Web Service

## Sources

- [Gamaredon Expands Ukraine Attacks with New Malware and Cloud Service Abuse](https://thehackernews.com/2026/06/gamaredon-expands-ukraine-attacks-with.html)
- [Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances](https://www.welivesecurity.com/en/eset-research/gamaredon-2025-leveraging-tunnels-workers-dead-drops-new-alliances/)
- [Gamaredon in 2025 (white paper PDF)](https://web-assets.esetstatic.com/wls/en/papers/white-papers/gamaredon-in-2025.pdf)
- [PteroLNK malware](https://www.broadcom.com/support/security-center/protection-bulletin/pterolnk-malware)
- [Inside Gamaredon's PteroLNK: Dead Drop Resolvers and evasive Infrastructure](https://harfanglab.io/insidethelab/gamaredons-pterolnk-analysis/)
- [Gamaredon Group (Threat Actor) - Malpedia](https://malpedia.caad.fkie.fraunhofer.de/actor/gamaredon_group)
- [Update WinRAR tools now: RomCom and others exploiting zero-day vulnerability](https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/)
- [Diverse Threat Actors Exploiting Critical WinRAR Vulnerability CVE-2025-8088](https://cloud.google.com/blog/topics/threat-intelligence/exploiting-critical-winrar-vulnerability)
- [CVE-2025-8088 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-8088)
- [CISA Known Exploited Vulnerabilities Catalog - CVE-2025-8088](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8088)
- [Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open](https://www.trendmicro.com/en_us/research/26/f/old-winrar-flaw-fuels-attacks-on-ukraine.html)
- [High-severity WinRAR 0-day exploited for weeks by 2 groups](https://arstechnica.com/security/2025/08/high-severity-winrar-0-day-exploited-for-weeks-by-2-groups/)
- [CVE-2025-8088: Rarlab WinRAR Path Traversal Vulnerability - SentinelOne](https://www.sentinelone.com/vulnerability-database/cve-2025-8088/)
- [WinRAR Vulnerability CVE-2025-8088 Remains Actively Exploited](https://pbxscience.com/winrar-vulnerability-cve-2025-8088-remains-actively-exploited-users-urged-to-update-immediately/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1216