InfoSecBulletin Cybersecurity for mankind
The Gamaredon hacking operates in rapid attacks, stealing data from breached systems in under an hour. Gamaredon, also known as Armageddon, UAC-0010, and Shuckworm, is a Russian cyber-espionage hacking group that enjoys state sponsorship. Some cybersecurity researchers are connected to the Russian Federal Security Service (FSB) because some of their members used to work for the SSU but left for Russia in 2014.
How they attack:
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
The hackers mostly use emails and messages in instant messengers (Telegram, WhatsApp, Signal) they send from earlier compromised accounts as a primary compromise vector. The most widespread method is sending an archive containing an HTM or HTA file, initiating a chain of infection upon opening.
There is an option of spreading malware through infecting removable storage media, legitimate files (especially shortcuts), as well as through modifying Microsoft Office Word templates, thus infecting every document created on the device by adding a respective macro.
Within 30–50 minutes following the initial infection, the perpetrators are able to steal files with the extensions .doc, .docx, .xls, .xlsx, .rtf, .odt, .txt, .jpg, .jpeg, .pdf, .ps1, .rar, .zip, .7z, .mdb, mostly by using GAMMASTEEL malware products.
A device operating in the affected status for about a week may contain 80 to 120 or more malicious (infected) files, apart from the files to be created on removable media that have been connected to the device during this period.
Specialists of the Computer Emergency Response Team of Ukraine (CERT-UA) acting under the SSSCIP have analyzed current tactics, techniques and procedures employed by the UAC-0010 (Armageddon /Gamaredon), one of the most active and dangerous russian hacking groups.
As mentioned earlier, the group includes former “officers” of the Security Service of Ukraine in the Autonomous Republic of Crimea, who have betrayed their homeland and started ministering to Russian federal security.
Cyber spying against Ukrainian security and defense forces is the group’s key objective. Additionally, there is at least one known case of destructive activity at an information infrastructure facility.
According to the CERT-UA, the number of infected computing devices operating mostly within information and communication systems of public agencies can reach several thousand at a time.
CERT-UA says, In case of a detected exposure upon the indicators specified by the CERT-UA, please report to the ITC Cybersecurity Center immediately.
Besides, specialists of the Computer Emergency Response Team of Ukraine urge soldiers of the Armed Forces of Ukraine to contact the ITC Cybersecurity Center (m/u А0334; email: [email protected]) at once if your device lacks an EDR class protection software (not antivirus) to have appropriate software installed.
