A new cyber threat actor, dubbed “GamaCopy,” has been identified mimicking the tactics of the Kremlin-aligned Gamaredon group in attacks targeting Russian-speaking entities. GamaCopy is linked to another group known as Core Werewolf (also called Awaken Likho and PseudoGamaredon) and utilizes military-themed lures to deploy UltraVNC for remote access to compromised systems. These attacks involve self-extracting archive files to deliver payloads, with measures like naming malware “OneDrivers.exe” to avoid detection. The group’s methods resemble Core Werewolf’s campaigns, which similarly use open-source tools and spear-phishing to compromise targets. GamaCopy is one of several actors exploiting the ongoing Russo-Ukrainian conflict, joining others like Sticky Werewolf and Venture Wolf in conducting phishing and data theft campaigns.