Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances

In 2025, Gamaredon intensified its cyberespionage against Ukraine by expanding its toolset, forging new alliances, and increasingly leveraging legitimate online services—including tunnels, workers, dead drops, and cloud storage—to conceal its infrastructure and exfiltrate sensitive data, making its operations more resilient and harder to disrupt.