Adversary Intelligence — 2026-06-03

FSB-Linked Gamaredon Exploits WinRAR CVE to Deploy GammaWorm and GammaSteel Against Ukrainian Targets

BLUFGamaredon's dead-drop C2 refresh and USB propagation make partial remediation futile, likely forcing full system wipes across compromised Ukrainian military and government networks.

Sekoia's TDR team, working from artifacts recovered from 70+ compromised hosts, reconstructed a Gamaredon infection chain observed in January 2026 and still active at publication: weaponized xHTML files exploit CVE-2025-8088, a WinRAR path traversal flaw, to plant a hidden HTA file in Windows Startup and launch a VBScript loader cascade designated GammaLoad 12. GammaWorm hides its modules in NTFS Alternate Data Streams, persists via scheduled tasks, propagates to USB and network drives through malicious LNK shortcuts, and resolves C2 addresses via Telegram channels used as dead drops 13. GammaSteel, delivered by the same chain, stores 71 DPAPI-encrypted modules in the Windows registry and exfiltrates targeted files to AWS S3 1. Sekoia warned that continuous dead-drop C2 refresh defeats standard cleanup attempts and recommended full system wipes and updating WinRAR to version 7.13 3.

Analysis
The dead-drop C2 architecture defeats standard incident response: each GammaLoad cascade stage independently retrieves fresh payloads, so partial cleanup reliably restores the infection chain and full system wipes are the only viable remediation. GammaWorm's USB propagation reaches air-gapped segments, a particular exposure for Ukrainian military and government networks where physical media transfer is routine. Moderate confidence, grounded in Sekoia's artifact-rich reconstruction from over 70 compromised hosts but constrained by single-source structure with no independent cross-corroboration, qualifies the technical picture. The artifacts reportedly came via an unnamed partner, raising the possibility the 70+ cases reflect a concentrated organizational compromise rather than sector-wide penetration. CISA will likely add CVE-2025-8088 to the Known Exploited Vulnerabilities catalog within 90 days of Sekoia's June disclosure. Without that listing, CISA-obligated organizations carry no binding WinRAR remediation deadline despite confirmed Gamaredon exploitation.

4 sources

FSB's matryoshka #1/3 - Gamaredon's gifts that keeps unpacking - GammaPhish and GammaWorm - Sekoia
Gamaredon Exploits WinRAR to Deliver GammaWorm and GammaSteel Against Ukraine - The Hacker News
FSB Group Gamaredon Hides Worm in Windows Data Streams - Infosecurity Magazine
Russian hackers exploit WinRAR vulnerability for data theft - SC Media