Gamaredon Exploits WinRAR Flaw to Deploy Modular Gamma Malware in Ukraine

Researchers attributed a January 2026 cyberespionage campaign against Ukrainian government, military, and critical infrastructure organizations to the Russia-linked Gamaredon group, which used booby-trapped spearphishing attachments and malicious RAR archives exploiting WinRAR path traversal flaw CVE-2025-8088 for initial access. The infection chain dropped an HTA payload dubbed GammaPhish, which launched via mshta.exe and fetched follow-on VBScript components including GammaLoad, GammaWorm, and GammaSteel. Sekoia said the operation marks a shift from Gamaredon’s older Pteranodon tooling to a fragmented, modular ecosystem in which multiple stages can independently act as backdoors and retrieve arbitrary remote code.

The malware emphasized stealth, persistence, and resilient command-and-control. GammaWorm established persistence through scheduled tasks and RunOnce registry keys, hid modules in NTFS Alternate Data Streams, and spread through USB devices and network shares using malicious LNK shortcuts, including into air-gapped environments. Command-and-control discovery relied on dead-drop resolvers hosted on Telegram, Telegra.ph, graph.org, Teletype, Cloudflare Workers, and operator infrastructure, while GammaSteel staged dozens of DPAPI-encrypted modules in the registry and exfiltrated selected files to AWS S3 or other S3-compatible storage with fallback to attacker-controlled servers. Because fresh payloads can be fetched at multiple stages, researchers warned that confirmed compromises may require full system wiping.