While the battlefield in eastern Europe continues to draw global attention, a parallel war is being waged in cyberspace — and one of its most relentless combatants is showing no signs of slowing down. Gamaredon, the Russian state-sponsored threat group with deep ties to the FSB, has significantly expanded both the sophistication and scale of its offensive cyber operations against Ukrainian targets throughout 2025, deploying new malware families and exploiting trusted cloud platforms to stay one step ahead of defenders.
A Campaign Machine in Full Swing
Researchers tracking the group have identified at least 35 distinct spear-phishing campaigns launched this year alone, with activity concentrating heavily in the second half of 2025. This cadence is remarkable even by APT standards — most sophisticated threat actors operate with restraint to avoid exposure. Gamaredon's willingness to operate at this volume reflects a strategic calculus: persistence and saturation matter more than stealth when the objective is ongoing intelligence collection from a wartime adversary.
The group's targeting continues to center on Ukrainian government institutions, military personnel, and critical infrastructure operators — entities whose compromised communications and internal documents hold significant intelligence value for Moscow. Spear-phishing remains the group's preferred initial access vector, with lures carefully crafted to exploit the urgency and stress inherent in wartime communications.
New Malware, Familiar Objectives
What makes Gamaredon's 2025 operations particularly noteworthy is the active expansion of its custom malware toolkit. The group has historically relied on a rotating set of bespoke tools — often written in scripting languages like PowerShell and VBScript — that prioritize flexibility and rapid modification over technical complexity. This year, researchers have observed the introduction of new malware strains designed to improve persistence, lateral movement, and data exfiltration capabilities.
These tools are rarely elegant. But elegance isn't the point. Gamaredon's malware philosophy centers on functionality and adaptability — code that can be quickly rewritten when signatures are burned, deployable by operators with varying technical skill levels. This approach has allowed the group to maintain operational continuity even as their infrastructure gets repeatedly disrupted and their tooling gets publicly documented.
The Cloud Abuse Problem
Perhaps the most strategically significant development in Gamaredon's 2025 playbook is the systematic abuse of legitimate cloud and web services as part of their attack infrastructure. By routing command-and-control communications through trusted platforms — services whose traffic is routinely whitelisted by enterprise security tools — the group effectively launders its malicious activity through the reputational credibility of major technology providers.
When attackers communicate through the same cloud services your organization trusts for business operations, traditional network-based detection becomes significantly less reliable.
This technique, broadly known as "living off trusted sites" or LOTS, represents a growing challenge for defenders. Blocking these platforms outright is rarely a viable option for organizations that depend on them for daily operations. Instead, defenders must rely on behavioral analytics, anomaly detection, and context-aware monitoring to distinguish legitimate use from malicious abuse — a considerably more complex and resource-intensive undertaking.
What This Escalation Signals
Gamaredon's operational tempo in 2025 reflects a broader pattern in Russian cyber strategy: sustained, high-volume pressure designed to wear down defenders, gather intelligence, and create ongoing disruption rather than deliver singular, high-impact strikes. Unlike more surgical APT actors, Gamaredon functions more like a persistent harassment operation — one that accepts a high detection rate in exchange for the intelligence gathered from successful intrusions.
For organizations outside Ukraine, this group's evolution carries important lessons. The techniques being refined against Ukrainian targets — cloud service abuse, spear-phishing at scale, rapidly mutating malware — are transferable and will increasingly appear in campaigns against NATO member states and Western private sector entities as geopolitical tensions persist.
What You Should Do
The war in Ukraine has become a live laboratory for offensive cyber tradecraft, and Gamaredon is one of its most prolific experimenters. Understanding how this group operates — and how it continues to adapt — isn't just relevant for Ukrainian defenders. It's a preview of what the broader threat landscape is likely to absorb and replicate in the years ahead.
