President Donald Trump offered to help broker a resolution to the Ukraine war during a nearly 90-minute call with Russian President Vladimir Putin on Saturday. The discussion focused on finding a diplomatic settlement to the ongoing conflict, which has seen significant escalation in recent months involving long-range strikes on infrastructure. Both leaders explored the possibility of a political solution based on Russia's stated fundamental approach to the war.

Kremlin Claims Battlefield Gains

Kremlin aide Yuri Ushakov stated that the conversation was "business-like and quite constructive." During the call, Putin described the battlefield situation, asserting that Russian forces are "confidently advancing, liberating one locality after another." Russia claimed it had taken control of Kostiantynivka, an industrial city in Ukraine’s Donetsk region known for its glassmaking industry. Ukraine has denied this claim.

Dispute Over Territory

Ukrainian President Volodymyr Zelenskyy rejected the Russian assertion, calling it "just another Russian lie" designed to create a news story. He challenged the claim by suggesting that if Kostiantynivka were truly under Russian control, Putin would have no issue meeting him there to discuss ending the war. Kremlin spokesperson Dmitry Peskov dismissed the proposed meeting, reiterating that the city is already part of Russia and that the invitation for Zelenskyy to meet in Moscow remains open.

Diplomatic Channels Remain Open

Despite the disagreements, Zelenskyy described his separate conversation with Trump as "very good." The leaders discussed the war’s 1,200-kilometre front line and agreed to continue talks at the upcoming NATO summit in Turkey. According to Ushakov, Trump indicated that U.S. envoys Steve Witkoff and Jared Kushner would continue efforts to broker a settlement and are prepared to make another visit to Moscow.

ESET Research released a report on June 25, 2026, detailing the 2025 operations of the Russia-aligned Gamaredon threat group, which exclusively targeted Ukrainian governmental and military institutions. The group focused on exfiltrating sensitive information to support Russian interests in the ongoing war. Gamaredon's activities remained closely aligned with Russia's geopolitical objectives, aiming to gain an intelligence advantage through cyberespionage.

Throughout 2025, Gamaredon operators developed and deployed six new malicious PowerShell tools: PteroDee, PteroCache, PteroDum, PteroOdd, PteroPaste, and PteroEffigy. PteroPaste stood out for its complexity, combining a downloader, a USB weaponizer, and a runner component for persistence. The group also resurrected an old VBScript weaponizer, PteroSetup, which first appeared in 2021.

Gamaredon collaborated with Turla, another Russia-aligned threat actor, in early 2025, underscoring potential coordination among cyberespionage groups. ESET researcher Zoltán Rusnák noted that Gamaredon took a short operational break in January 2025 but remained highly active afterward, with updates often timed around major Russian and Crimean holidays. The group is attributed by the Security Service of Ukraine to the 18th Center of Information Security of Russia’s FSB.

The group shifted its tactics in the second half of 2025, launching larger and more frequent spear phishing campaigns. Beyond phishing, Gamaredon used custom weaponizers for lateral movement, targeting USB drives, mapped network drives, and software installers to spread within or across organizations.

Gamaredon increasingly relied on legitimate third-party services to hide its command and control (C&C) infrastructure and stolen data. The group abused messaging, social media, and blogging services like Telegram, Dropbox, DEV Community, and Mastodon as dead drops for resolving C&C servers and distributing payloads. Additionally, C&C servers were hidden behind tunnels, workers, dynamic DNS (DDNS), and platform as a service (PaaS) solutions.

On the data-exfiltration front, Gamaredon upgraded its file stealers, PteroPSDoor and PteroVDoor, to support S3-compatible cloud storage services like Wasabi, Tebi, and Intercolo. This shift reduced the need for the group to maintain its own infrastructure and helped malicious traffic blend in with legitimate storage providers. PteroBox continued to upload files to Dropbox.

New Tools Introduced by Gamaredon in 2025

Cloud Storage Services Used for Exfiltration