Overview

The Gamaredon group, a known threat actor, has been actively targeting Ukrainian governmental and military institutions with spear-phishing campaigns. In 2025, ESET reported 35 distinct campaigns, primarily in the latter half of the year. This ongoing cyberattack effort highlights the importance of understanding the threat and implementing effective defensive measures.

Understanding the Vulnerability / Threat

Root Cause Analysis

The root cause of this threat is the use of spear-phishing campaigns to gain initial access to the targeted institutions' networks. The attackers exploit human vulnerabilities rather than technical ones, using social engineering tactics to trick victims into opening malicious emails or attachments.

Attack Surface & Vector

The attack surface for this threat is the email inbox of employees in Ukrainian governmental and military institutions. The vector used by the attackers is spear-phishing emails, which are tailored to specific individuals or groups within these institutions.

Exploitation Mechanics — Scenario Walkthrough

Scenario: Compromising a Ukrainian Governmental Institution via Spear-Phishing

  1. Initial Position: The attacker, part of the Gamaredon group, has a list of targeted email addresses within Ukrainian governmental institutions.
  2. Triggering the Flaw: The attacker sends a spear-phishing email to a specific individual, using a subject line and content designed to entice the victim to open an attached malicious file or link.
  3. What Breaks: The victim opens the malicious attachment or clicks on the link, executing the malware or loading a malicious webpage. This allows the attacker to bypass security measures and gain a foothold in the institution's network.
  4. Attacker's Prize: The attacker now has access to the victim's email account and potentially other sensitive information within the institution's network. The attacker can use this access to gather intelligence, spread malware, or conduct further attacks.

Real-World Impact

The real-world impact of these cyberattacks can be significant, including:

  • Data theft: sensitive information, such as government communications or military operations, may be stolen.
  • Lateral movement: the attackers may move laterally within the institution's network, compromising additional systems and data.
  • Disruption of services: the attacks may disrupt critical services or operations within the targeted institutions.

Detection & Defense

Immediate Mitigations

To mitigate these attacks, institutions can:

  • Implement robust email filtering and security measures to block spear-phishing emails.
  • Conduct regular security awareness training for employees to educate them on the risks of spear-phishing and how to identify suspicious emails.

Detection Strategies

Detection strategies may include:

  • Monitoring email traffic for suspicious activity, such as unusual sender addresses or attachments.
  • Implementing intrusion detection systems to detect and alert on potential malware activity.

Long-Term Hardening

Long-term hardening strategies may include:

  • Implementing multi-factor authentication to protect email accounts and other sensitive systems.
  • Conducting regular vulnerability assessments and penetration testing to identify and address potential weaknesses.

Key Takeaways

  • Spear-phishing campaigns are a significant threat to governmental and military institutions.
  • Human vulnerabilities, rather than technical ones, are often the root cause of these attacks.
  • Implementing robust email security measures and conducting regular security awareness training can help mitigate these attacks.

Sources

  • SC Magazine: Gamaredon group expands malware arsenal in ongoing Ukraine cyberattacks