The State Cyber Protection Centre (SCPC) of Ukraine has called out the Russian state-sponsored threat actor known as Gamaredon for its targeted cyber attacks on public authorities and critical information infrastructure in the country.
The advanced persistent threat, also known as Actinium, Armageddon, Iron Tilden, Primitive Bear, Shuckworm, Trident Ursa, and UAC-0010, has a track record of striking Ukrainian entities dating as far back as 2013.
“UAC-0010 group’s ongoing activity is characterized by a multi-step download approach and executing payloads of the spyware used to maintain control over infected hosts,” the SCPC said. “For now, the UAC-0010 group uses GammaLoad and GammaSteel spyware in their campaigns.”
GammaLoad is a VBScript dropper malware engineered to download next-stage VBScript from a remote server. GammaSteel is a PowerShell script that’s capable of conducting reconnaissance and executing additional commands.
The goal of the attacks is geared more towards espionage and information theft rather than sabotage, the agency noted. The SCPC also emphasized the “insistent” evolution of the group’s tactics by redeveloping its malware toolset to stay under the radar, calling Gamaredon a “key cyber threat.”
images from Hacker News