Russia-Linked Gamaredon Group Targets Ukraine with Remcos RAT

The Russia-linked cyberespionage group Gamaredon is targeting Ukraine with a phishing campaign using military-themed lures to deploy the Remcos RAT via a PowerShell downloader. Researchers at Talos have identified this campaign, attributing it to the APT group Gamaredon, also known by the names Armageddon, Primitive Bear, ACTINIUM, and Callisto. This group is responsible for a series of spear-phishing attacks targeting Ukrainian entities and related organizations.