GammaWorm
GammaWorm is a heavily obfuscated VBScript worm and propagation component in the Gamaredon "Gamma" malware ecosystem, attributed in the provided reporting to the Russia-linked, FSB-associated Gamaredon threat actor. It was observed in campaigns targeting Ukrainian government, military, and critical infrastructure entities. The malware is described as part of a modular intrusion chain that can be delivered via GammaLoad following initial access through weaponized XHTML lures and a malicious RAR archive exploiting WinRAR path traversal vulnerability CVE-2025-8088; reporting also notes the exact deployment vector for GammaWorm may be ambiguous and could include introduction through a weaponized USB drive.
GammaWorm establishes persistence through scheduled tasks, including DiskDiagnosticDataCollector, SilentCleanup, and SmartRetry, and also uses a RunOnce registry key such as HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\ExplorerGuard, which it recreates at user login. It hides its core modules in NTFS Alternate Data Streams rather than conventional files, with reported ADS names including %USERPROFILE%:GTR, %USERPROFILE%:save, %USERPROFILE%:URL, %USERPROFILE%:LNK, and %USERPROFILE%:SERVER. It also modifies Explorer settings to hide hidden files, protected operating system files, and known file extensions.
For propagation, GammaWorm targets USB drives and network shares. It hides legitimate directories and replaces them with malicious Windows Shortcut (LNK) files. These LNK files open the expected folder while silently executing the worm, including a worm file named "~.gif" from the infected drive root; reporting also states the shortcuts use mshta.exe and wscript.exe. GammaWorm additionally creates lure LNK files with Ukrainian-language filenames, including military-, secret-, and explicit-content-themed names. The malware ecosystem is explicitly described as enabling USB-based propagation across air-gapped systems.
GammaWorm also functions as a stealth backdoor. It continuously contacts command-and-control infrastructure, exfiltrates victim system fingerprints, and retrieves arbitrary VBScript payloads for in-memory execution. It resolves C2 through dead-drop resolvers and legitimate platforms, including Telegram, graph.org, teletype.in, telegra.ph, Cloudflare Workers, and operator-controlled infrastructure. One reported Telegram dead-drop URL is https://www.telegram.me/s/oberfarir, and one reported downstream C2 IP is 104.194.140.6. Reporting states GammaWorm used curl to access a hard-coded public Telegram channel and parse an obfuscated IP address from returned HTML. Exfiltrated host fingerprint data was reportedly placed in randomized HTTP headers, specifically the User-Agent string, rather than the request body.
Known indicators directly mentioned in the content include sample MD5 8e1624d110c090ff57d4b493a9107c66 for a GammaWorm sample named "~.gif", the Telegram dead-drop URL https://www.telegram.me/s/oberfarir, and C2 IP 104.194.140.6.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
According to Sekoia, the attack consists of exploiting the bug CVE-2025-8088, a path traversal bug in WinRAR, to run an HTML App payload called GammaPhish, which is later used to get a VBScript payload from the C2 server.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
GammaWorm is the propagation component... It doesn’t drop traditional files. Instead it writes its core modules into NTFS Alternate Data Streams... The propagation module targets USB drives and network shares.
Techniques & procedures
23 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 techniqueExecution
4 techniquesThe malware maintains persistence through three scheduled tasks with names borrowed from legitimate Windows services: DiskDiagnosticDataCollector, SilentCleanup, and SmartRetry. Each one executes a different ADS module at short intervals, from 7 to 10 minutes.
resulting in the execution of arbitrary code retrieved from a command-and-control (C2) server
We recovered multiple VBScript loaders from the compromised hosts. It seems that these loaders operate in a continuous cascade, with four distinct execution stages observed during our analysis.
hide authentic directories in network shares and USB drives and replace with infected Windows Shortcut (LNK) files. This causes the launch of arbitrary code
Persistence
4 techniquesThe malware maintains persistence through three scheduled tasks with names borrowed from legitimate Windows services: DiskDiagnosticDataCollector, SilentCleanup, and SmartRetry. Each one executes a different ADS module at short intervals, from 7 to 10 minutes.
Next, to mask its future propagation activities, GammaWorm alters several registry keys within HKEY_USERS\[SID]\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\.
GammaWorm also writes a RunOnce registry key that recreates itself on every user login, because GammaWorm itself rewrites the key before the RunOnce entry gets deleted.
It hides real folders by setting their attributes to Hidden and System, then drops malicious LNK shortcut files in their place using the same folder name and icon. Clicking the LNK opens the real folder in Explorer so the user sees nothing wrong, while silently executing ~.gif, the worm file that sits at the root of every infected drive.
Privilege Escalation
3 techniquesThe malware maintains persistence through three scheduled tasks with names borrowed from legitimate Windows services: DiskDiagnosticDataCollector, SilentCleanup, and SmartRetry. Each one executes a different ADS module at short intervals, from 7 to 10 minutes.
GammaWorm also writes a RunOnce registry key that recreates itself on every user login, because GammaWorm itself rewrites the key before the RunOnce entry gets deleted.
It hides real folders by setting their attributes to Hidden and System, then drops malicious LNK shortcut files in their place using the same folder name and icon. Clicking the LNK opens the real folder in Explorer so the user sees nothing wrong, while silently executing ~.gif, the worm file that sits at the root of every infected drive.
Stealth
3 techniquesThe extracted HTA file contains a VBScript blob comprising approximately 90% of junk and obfuscated code.
The module iterates from the root level through all folders. It modifies their attributes to Hidden and System, removing them from the user’s standard view.
Instead it writes its core modules into NTFS Alternate Data Streams, a native Windows feature that lets data sit invisibly attached to a folder path, invisible to standard directory listings and not reflected in file sizes visible to users. | It hides real folders by setting their attributes to Hidden and System, then drops malicious LNK shortcut files in their place using the same folder name and icon.
Defense Impairment
1 techniqueDiscovery
1 techniqueGammaLoad (Staging): We recovered multiple VBScript loaders from the compromised hosts... Their primary objectives are to fingerprint the host system...
Lateral Movement
2 techniquesThe propagation module targets USB drives and network shares.
The propagation module targets USB drives and network shares.
Collection
2 techniquesIts malware ecosystem, including GammaPhish and GammaWorm, enables USB-based propagation across air-gapped systems, document theft, and continuous deployment of additional payloads
The exact deployment vector for GammaWorm remains ambiguous... or introduced independently via a user executing a weaponized USB drive
Command and Control
5 techniquesTo find its C2 address, GammaWorm runs curl against a hard-coded public Telegram channel, parses the HTML for an obfuscated IP address... The C2 resolution chain itself is layered: it hops through graph.org, Cloudflare Workers, Teletype, Telegra.ph, and Telegram before arriving at an operator-controlled server.
By using legitimate platforms like Telegram, the idea is to blend in with regular traffic, avoid detection, and sustain long-term espionage operations
Their primary objectives are to fingerprint the host system, update the network configuration in the registry using Dead Drop Resolvers (DDRs), fetch and execute arbitrary VBScript payloads from the C2 servers.
If the C2 returns HTTP 200, it executes arbitrary VBScript from the response body.
GammaWorm resolves live servers through Dead Drop Resolvers hosted on services like Telegraph/Teletype via graph.org, Cloudflare Workers subdomains and S3‑compatible storage... The group also leverages public Telegram channels as dead drops...
Exfiltration
3 techniquesGammaWorm runs a continuous loop that acts as a stealth backdoor, regularly contacting its C2 to exfiltrate system fingerprints...
To find its C2 address, GammaWorm runs curl against a hard-coded public Telegram channel, parses the HTML for an obfuscated IP address, and posts the victim’s machine fingerprint back via randomized HTTP headers, specifically inside the User-Agent string. No request body, just headers.
The group employs a stealthy, multi-stage infection chain that abuses legitimate Windows features and trusted services such as Telegram, Cloudflare, and cloud storage to maintain persistent access while minimizing detection.
IOCs tracked for this family
15 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Propagation-focused VBScript malware that spreads via USB drives and network shares, stores modules in NTFS Alternate Data Streams, maintains persistence with scheduled tasks and RunOnce abuse, resolves C2 through Telegram-based dead drops, and executes arbitrary VBScript from C2 responses.
A VBScript worm that establishes persistence via scheduled tasks, spreads through network shares and USB drives by replacing directories with malicious LNK files, uses Telegram for C2 resolution, and hides modules using NTFS Alternate Data Streams.
A VBScript worm that establishes persistence via scheduled tasks, propagates through network shares and USB drives by replacing directories with malicious LNK files, uses Telegram for C2 resolution, and conceals modules using NTFS Alternate Data Streams.
A VBScript-based worm and stealth backdoor used by Gamaredon that hides in NTFS Alternate Data Streams, persists via RunOnce and scheduled tasks, propagates through USB and network drives using malicious LNK shortcuts, and uses cloud/dead-drop infrastructure for C2 and payload retrieval.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.