The Russian hacking gang Gamaredon has strengthened its cyberespionage capabilities and continues to prevail.
The Gamaredon gang, also known as Armageddon, has been active since at least 2013 and is likely operating from the Russian-annexed Crimean peninsula. The gang is believed to be acting on orders from Russia's Federal Security Service (FSB).
Read more: Multiple Iranians accused of hacking Donald Trump's campaign
The majority of the Gamaredon group's attacks target Ukrainian government institutions. However, researchers at Slovak cybersecurity ESET discovered that, since Russia's invasion of Ukraine in 2022, the group has also attempted to attack Ukraine's allies in several NATO, including Bulgaria, Latvia, Lithuania, and Poland.
The scale of Gamaredon's attacks in Ukraine is significant, according to the researchers. In 2022 and 2023, they observed more than a thousand unique devices in Ukraine targeted by the group.
Gamaredon has incorporated several new tools into its arsenal, but remains technically less sophisticated, with the hackers making no serious efforts to conceal their activity. The group's operators "are reckless and don't mind being discovered by defenders during their operations," the researchers said.
See also: Hackers hide malware in fake 'deleted Diddy files'
However, hackers go to great lengths to avoid being blocked by security measures and work hard to maintain access to compromised systems, frequently updating their tools and regularly changing decryption techniques.
To gain initial access to their victims' systems, the gang relies primarily on spearphishing, using custom malware to infect Word and USB drives.
Ukraine has warned about cyber threats from the Gamaredon gang, calling it “one of the most active and threatening groups targeting Ukraine during its war with Russia.” In August, Gamaredon attacked Ukraine’s armed forces and government agencies, taking advantage of the country’s long-awaited counterattack.
Read more: Cloudflare: Warns of hacking gang targeting Asia
In 2022, the group attempted to compromise a major oil refining company in a NATO member state. In June, two hackers possibly associated with Gamaredon were sanctioned by the European Council for attacks against the EU. ESET says that Gamaredon's main priority remains Ukraine, stressing that "this trend is expected to continue without significant changes in targeting.".
Source: therecord
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
