CampaignPublished 1 Sep 2025Updated 1 Oct 2025

Analysis of APT-C-53 (Gamaredon) Attack on Ukrainian Government Agencies

Source AlienVault OTX General

Description

APT-C-53, also known as Gamaredon, is a Russian state-sponsored threat group active since 2013, targeting Ukrainian government and military entities. The group has upgraded its attack techniques, focusing on dynamic cloud-based C2 infrastructure and targeted delivery of cloud storage tools. In 2025, they conducted high-density intelligence theft activities against Ukrainian government agencies. The attack chain involves dynamic changes in infrastructure, abuse of Microsoft Dev Tunnels, and sophisticated data exfiltration techniques. The group employs white-listed domain camouflage, domain shadowing, and weaponization of cloud tunnel services to evade detection. Their data theft process includes registry-based persistence, multi-stage payload delivery via Cloudflare Workers, and exfiltration through legitimate cloud tools like Dropbox.

Impact

For European organizations, particularly those with governmental, defense, or critical infrastructure roles, this threat underscores the risk posed by state-sponsored cyberespionage campaigns that exploit cloud services and dynamic infrastructure to evade detection. Although the primary target is Ukrainian government agencies, the tactics and infrastructure abuse techniques employed by APT-C-53 could be adapted or extended to other European entities, especially those involved in geopolitical matters related to Russia and Ukraine. The use of legitimate cloud services for command and control and data exfiltration complicates traditional network monitoring and may lead to undetected breaches, resulting in loss of sensitive information, espionage, and potential disruption of governmental operations. The campaign's reliance on scripting and registry persistence also means that infected systems could be used as footholds for further lateral movement or supply chain attacks within European networks. The medium severity rating reflects the targeted nature of the campaign and the complexity of the attack chain, which requires skilled adversaries but can result in significant confidentiality breaches if successful.

Defensive guidance

European organizations should implement advanced detection and response capabilities focused on cloud service abuse and dynamic infrastructure changes. Specific recommendations include: 1) Monitor and restrict the use of Microsoft Dev Tunnels and similar cloud tunneling services within corporate networks, employing strict access controls and logging; 2) Deploy behavioral analytics to detect unusual scripting activity, especially involving PowerShell and VBScript, and monitor registry modifications indicative of persistence mechanisms; 3) Implement domain reputation and shadow domain detection tools to identify suspicious domain shadowing and white-listed domain camouflage; 4) Use cloud access security broker (CASB) solutions to monitor and control data flows to and from legitimate cloud storage services like Dropbox, with particular attention to anomalous upload patterns; 5) Conduct regular threat hunting exercises focusing on indicators of compromise such as the provided hashes, IPs, and domains; 6) Enforce strict email filtering and phishing awareness training to prevent initial infection vectors; 7) Maintain up-to-date endpoint detection and response (EDR) solutions capable of detecting multi-stage payload delivery and deobfuscation techniques; 8) Collaborate with cloud service providers to gain visibility into suspicious activities and leverage threat intelligence sharing platforms for timely updates on emerging tactics used by APT-C-53 and similar groups.

Indicators of compromise

Domains 6

bulam.ru
fulagam.ru
litanq.ru
nandayo.ru
80.euw.devtunnels.ms
euw.devtunnels.ms

URLs 1

http://nandayo.ru/srgssdfsf

IP addresses 2

194.67.71.128
31.129.22.156

Hashes 7

023429e53d32fa29e4c7060c8f3d37db
0459531e3cbc84ede6a1a75846a87495
67896b57a4dcf614fb22283c130ab78b
9258a427c782cd8d7dcf25dc0d661239
98b540aeb2e2350f74ad36ddb4d3f66f
d2c551812c751332b74b0517e76909f2
f3deebe705478ec1a4ec5538ac3669cb

Email addresses 2

megamarket.ua@p9tm15n7-80.euw.devtunnels.ms
wise.com@p9tm15n7-80.euw.devtunnels.ms

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 1 Sep 2025, 10:33 UTC

MITRE ATT&CK techniques11 from threat tags

Technical details