Gamaredon in 2025: Tunnels, Workers, Dead Drops, and New Alliances

Summary

Gamaredon, a Russia-aligned APT group, has further adapted its operations in 2025 by abusing legitimate third-party services to conceal command-and-control infrastructure and data theft activity. The group relies on tunnels, workers, and dead-drop platforms such as Telegram and Dropbox to obscure malicious traffic. It has also introduced new PowerShell-based tooling and updated its file stealers to support exfiltration to S3-compatible cloud storage.

Investigation

ESET Research reviewed Gamaredon’s 2025 operations and observed a shift toward larger spearphishing campaigns combined with HTML smuggling techniques. The investigation identified new delivery tools, heavier use of Cloudflare workers and tunnels, and continued reliance on dead-drop resolvers. Researchers also documented cooperation with other Russia-aligned actors, including Turla.

Mitigation

Defenders should watch for unusual outbound connections to legitimate cloud storage platforms and serverless services. Enforcing strict controls over HTA and VBScript execution can help block the early stages of infection. Monitoring for abuse of dynamic DNS services and commonly used dead-drop platforms is also recommended.

Response

If Gamaredon activity is detected, affected systems should be isolated immediately to prevent further movement through weaponized USB devices or network shares. Investigators should conduct a full review of any unauthorized access to cloud storage accounts. Telemetry should also be checked for connections to known tunnel and worker services associated with the group.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary aims to establish a foothold by downloading a secondary stage payload. To avoid detection by basic signature-based tools, they typically use specific downloader modules. In this simulation, we will first execute the “detectable” version to confirm the rule works, and then execute an “obfuscated” version to demonstrate the rule’s weakness. The goal is to simulate the execution of the PteroDee module which fetches C2 instructions from a cloud-hosted file.

• Regression Test Script:

  # --- PART 1: SUCCESSFUL DETECTION (The "Loud" Attack) ---
  Write-Host "[+] Executing detectable command..."
  powershell.exe -ExecutionPolicy Bypass -Command "& {Write-Host 'Initializing PteroDee downloader...'; Start-Sleep -s 2}"
  
  # --- PART 2: EVASION TEST (The "Stealthy" Attack) ---
  # This demonstrates how an adversary bypasses the rule using string concatenation
  Write-Host "[+] Executing obfuscated command (Evasion)..."
  $part1 = "Ptero"
  $part2 = "Dee"
  $cmd = "& {Write-Host 'Initializing ' + '$part1' + '$part2' + ' downloader...'; Start-Sleep -s 2}"
  powershell.exe -ExecutionPolicy Bypass -Command $cmd
  
  Write-Host "[+] Simulation Complete."

• Cleanup Commands:

  # No permanent changes made to the system. 
  # Simply clear the PowerShell history for the current session.
  Clear-History