Gamaredon Exploits WinRAR to Deliver GammaWorm and GammaSteel Against Ukraine

Gamaredon exploits WinRAR vulnerability CVE-2025-8088 to deliver malware families targeting Ukraine.

• •Uses GammaPhish HTML payload to retrieve GammaLoad downloader and execute VBScript from C2 servers
• •GammaWorm establishes persistence via scheduled tasks and uses Telegram for C2 communication to avoid detection
• •Employs NTFS Alternate Data Streams technique to hide core modules and sustain long-term espionage
• •GammaSteel stealer captures files and exfiltrates them to AWS S3 buckets or attacker-controlled servers
• •Targets Ukrainian government, military, and critical infrastructure through spear-phishing and malicious RAR archives

This summary was automatically generated by AI based on the original article and may not be fully accurate.