Ukraine has been subjected to increasingly robust cyberespionage campaigns by Russian state-sponsored hacking group Gamaredon, also known as Armageddon, which continues to be the most active state-backed operation against the country, reports The Record, a news site by cybersecurity firm Recorded Future.
Thousands of Ukrainian devices have been compromised by Gamaredon between 2022 and 2023, primarily through spear-phishing campaigns, an analysis from ESET showed. Despite its use of unsophisticated attack tools and lack of malicious activity concealment, Gamaredon has implemented frequent tool and obfuscation technique updates to bypass security solutions and ensure persistence in compromised systems, according to ESET researchers, who also noted that Ukraine will continue to be the primary target of the hacking operation despite intrusions against Bulgaria, Poland, Lithuania, and its other allies. Such findings come after Gamaredon was noted by Ukraine to be among the most dangerous threat actors amid its ongoing war with Russia.
