GammaSteel
GammaSteel is a modular information-stealing malware family in Gamaredon’s “Gamma” ecosystem, used for data theft in campaigns attributed to the Russia-linked, FSB-associated threat actor Gamaredon. It has been observed in late 2025 and January 2026 operations targeting Ukrainian victims, including government, military, and critical infrastructure entities. GammaSteel is delivered via GammaLoad in a broader intrusion chain that also includes GammaPhish for initial delivery and GammaWorm for propagation. The wider campaign used weaponized XHTML spearphishing attachments and malicious RAR archives exploiting WinRAR path traversal vulnerability CVE-2025-8088 to establish access.
Based on the provided reporting, GammaSteel is a modular stealer, including a PowerShell variant, that captures files matching selected extensions and exfiltrates them to an AWS / S3-compatible cloud storage bucket, with fallback to an attacker-controlled server. Sekoia reported obtaining a newer GammaSteel version by replaying GammaLoad-generated network requests, and described one recent variant as staging itself in the Windows registry as 71 DPAPI-encrypted modules before exfiltration. High-confidence behavior directly mentioned in the content is focused on targeted file theft and cloud-backed exfiltration with operator-controlled backup infrastructure. No additional specific file-extension list or standalone IOCs for GammaSteel were provided in the content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
According to Sekoia, the attack consists of exploiting the bug CVE-2025-8088, a path traversal bug in WinRAR, to run an HTML App payload called GammaPhish, which is later used to get a VBScript payload from the C2 server.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
This is part one of a three-part series; parts two and three cover GammaLoad and GammaSteel, respectively... Sekoia has now aligned the naming under a single taxonomy using the “Gamma” prefix: ... GammaSteel for data theft
Techniques & procedures
10 distinct techniques documented for this family, organized by ATT&CK tactic.
Discovery
1 techniqueTargeted files are exfiltrated to an S3-compatible cloud storage provider.
Collection
4 techniquesGammaSteel manages three concurrent data acquisition mechanisms: recurring scans of local and network drives, hardware event monitoring for newly inserted USBs...
GammaSteel manages three concurrent data acquisition mechanisms: recurring scans of local and network drives...
GammaSteel manages three concurrent data acquisition mechanisms: recurring scans of local and network drives, hardware event monitoring for newly inserted USBs, and real-time surveillance of specific files as they are saved or modified.
captures files matching certain extensions and exfiltrates them to an Amazon Web Services (AWS) S3 bucket or an attacker-controlled server
Command and Control
2 techniques"Gamaredon Uses Infected Removable Drives to Breach..."
This confirms the definitive transition from a single-block framework to a modular ecosystem where every component doubles as a functional backdoor.
Exfiltration
3 techniquesor an attacker-controlled server as a fallback mechanism
Targeted files are exfiltrated to an S3-compatible cloud storage provider. If the primary cloud infrastructure fails, GammaSteel falls back to operator-controlled C2 servers...
GammaSteel... stores files matching particular extensions and retrieves the stolen files on AWS S3 bucket or a threat-actor regulated server as a backup option.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Data theft component in Gamaredon’s modular malware taxonomy.
A modular information stealer that collects files with selected extensions and exfiltrates them to an AWS S3 bucket or attacker-controlled backup server.
A modular information stealer that collects files matching selected extensions and exfiltrates them to AWS S3 or an attacker-controlled server.
A data-theft component in Gamaredon's Gamma ecosystem.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.