Gamaredon Exploits WinRAR Vulnerability to Deploy GammaWorm and GammaSteel Against Ukraine

Executive Summary

The Russian state-sponsored threat actor Gamaredon has been observed exploiting CVE-2025-8088, a WinRAR path traversal vulnerability, to deliver a sophisticated multi-stage malware framework targeting Ukrainian entities. The campaign employs a modular infection chain involving GammaPhish, GammaLoad, GammaWorm, and GammaSteel to facilitate persistence, credential theft, intelligence collection, and data exfiltration.

Researchers assess the activity as part of an ongoing espionage operation focused on government, military, and critical infrastructure organizations within Ukraine.

Key Intelligence Overview

Threat Actor Attribution

Gamaredon is a Russian state-sponsored cyber espionage group publicly linked to the Russian Federal Security Service (FSB). The group has maintained a long history of conducting intelligence-gathering operations against Ukrainian government agencies, military organizations, and critical infrastructure providers.

The campaign demonstrates continued investment in modular malware development and the abuse of publicly disclosed vulnerabilities to gain initial access into target environments.

Targeted Sectors

• Government Agencies
• Military Organizations
• Defense Sector
• Critical Infrastructure
• Public Administration
• National Security Entities
• Strategic Communication Networks

Campaign Timeline

Attack Chain Analysis

Initial Access

Gamaredon exploits CVE-2025-8088 in WinRAR through malicious archive files distributed to targeted victims.

Execution

GammaPhish executes an HTML Application payload that launches the GammaLoad downloader.

Persistence

GammaWorm creates scheduled tasks and deploys malicious LNK files to maintain long-term access.

Defense Evasion

The malware stores modules within NTFS Alternate Data Streams (ADS) and leverages legitimate platforms such as Telegram for command-and-control resolution.

Credential Access & Collection

GammaSteel searches for sensitive files and collects information matching predefined extensions.

Exfiltration

Collected data is transmitted to AWS S3 buckets or attacker-controlled infrastructure.

Malware Ecosystem

MITRE ATT&CK Mapping

Indicators of Interest

• GammaPhish
• GammaLoad
• GammaWorm
• GammaSteel
• GammaWipe
• Telegram-based DDR communications
• Scheduled task persistence
• Malicious LNK files on USB drives
• AWS S3 data exfiltration

Detection Opportunities

• Monitor WinRAR exploitation attempts.
• Inspect HTA and VBScript execution events.
• Detect scheduled task creation anomalies.
• Monitor Telegram communication from enterprise endpoints.
• Identify NTFS Alternate Data Stream abuse.
• Inspect outbound AWS S3 traffic.
• Review suspicious LNK file propagation.

Defensive Recommendations

1. Patch WinRAR installations immediately.
2. Disable unnecessary script execution.
3. Monitor USB device activity.
4. Restrict HTA execution where possible.
5. Implement EDR monitoring.
6. Inspect scheduled task persistence.
7. Monitor cloud storage exfiltration channels.
8. Conduct threat hunting for Gamaredon TTPs.

Confidence Assessment

Confidence Level: High

Assessment is based on detailed malware analysis, observed exploitation activity, infrastructure investigation, and attribution findings published by Sekoia.

Analyst Assessment

Intelligence Sources

• The Hacker News
• Sekoia Threat Research
• MITRE ATT&CK Framework

References

• The Hacker News Report
• MITRE ATT&CK Framework

Share Report