In November 2018, the Ukrainian government and military fell victim to a targeted malware attack orchestrated by the Russian Gamaredon Group, a cyberespionage collective linked to Russia’s FSB. The attack leveraged the Pterodo backdoor, a sophisticated malware designed to infiltrate systems via malicious downloads or secondary payloads. This variant was engineered to activate exclusively on Windows 10 systems configured with languages from former Soviet states (Ukrainian, Russian, Belarusian, etc.), complicating automated detection. The malware generated unique C2 (command-and-control) URLs tied to the infected machine’s hard drive serial number, enabling attackers to exfiltrate system data and deploy additional tools remotely. The operation served as a spyware-driven intelligence-gathering campaign, extracting sensitive military and governmental data. The stolen information was later weaponized by Russia to seize Ukrainian naval vessels and imprison sailors, directly escalating geopolitical tensions. Domains like updates-spreadwork.pw and bitsadmin.ddns.net were tied to the attack, which CERT-UA confirmed as part of a broader disinformation and cyber-warfare strategy. The breach compromised strategic planning data, undermining Ukraine’s operational security and enabling Russia’s aggressive maritime actions in the Kerch Strait.