Reported by 7 outlets
Gamaredon APT Launches Fileless Campaign Against Ukraine — GammaWorm Uses NTFS ADS, Cloud Dead-Drop C2
Why this score
- Breadth
- 2.00 / 2.0 · 7 sources
- Authority
- 1.70 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
Sekoia's TDR team published part one of its FSB Matryoshka series on June 1, 2026, reconstructing a January 2026 Gamaredon intrusion chain aimed at Ukrainian government, military, and critical infrastructure. The chain opens with a weaponized XHTML file that pings a Supabase tracking pixel and HTML-smuggles a RAR archive exploiting CVE-2025-8088, the WinRAR path traversal patched in 7.13 on July 30, 2025. Extraction silently writes an HTA into the Startup folder; on next logon mshta.exe, disguised with a fake www.bbc.com@ credential prefix, pulls the next stage from Supabase. GammaWorm, a VBScript worm of over 20,000 obfuscated lines, hides its modules in NTFS Alternate Data Streams, persists through the RunOnce value ExplorerGuard and three scheduled tasks, and resolves C2 through Telegram, Telegra.ph, Teletype.in, and Cloudflare Workers dead drops. GammaSteel stages 71 DPAPI-encrypted modules in the Windows registry and pushes documents to S3-compatible storage. Sekoia assessed the campaign as still active at publication.
The notable fact is not the bug but its age. CVE-2025-8088 shipped with a patch on July 30, 2025, was exploited that same July by RomCom against European and Canadian targets per ESET, by a second actor documented by BI.ZONE, and was later tied by Google Threat Intelligence Group to Sandworm, Turla, Gamaredon, and China-nexus sets, yet it still opened a state espionage chain in January 2026. The binding constraint for defenders is therefore unpatched archive tooling, including third-party products that embed UnRAR.dll or its portable source, a dependency WinRAR's own release notes flag. A successful hit does not produce encryption or ransom demands; it produces permanent document espionage where every stage doubles as a backdoor, the worm spreads over USB and network shares to jump air gaps, and Sekoia judges a full system wipe the only safe remediation, an operationally expensive outcome for any government network.
Start with inventory: find WinRAR below 7.13 and any product shipping UnRAR.dll or portable UnRAR, then upgrade or isolate. Hunt for the stream names GTR, save, URL, LNK, and SERVER under %USERPROFILE% using dir /R or Get-Item -Stream, and alert on wscript.exe command lines carrying a colon path such as C:\Users\[USER]:GTR. Check for the RunOnce value ExplorerGuard, the HKCU\Console values WindowsUpdates, WindowsResponby, WindowsDetect, URLTeletype, WindowsTelegra, URLTelegra, and IpURL, and the scheduled tasks DiskDiagnosticDataCollector, SilentCleanup, and SmartRetry. On the network, flag non-browser processes fetching supabase.co, graph.org, workers.dev, teletype.in, telegra.ph, or t.me, and curl.exe saving telegram.me/s/oberfarir to Temp\cancelH0S.mpg. Two file hashes to sweep for: 1794369214b7f62e70a0485e61335c61 (xHTML lure) and 8e1624d110c090ff57d4b493a9107c66 (the ~.gif worm). Restrict USB storage where policy allows, and treat a confirmed host as a wipe, not a clean.
Two developments would move this assessment. Fresh exploitation of CVE-2025-8088 with new infrastructure would show the unpatched-archive-tooling problem persists beyond Ukraine and push a re-scan of any fleet still below 7.13. And any appearance of the GamaWiper payload outside the researcher sandboxes where ClearSky saw it would signal that Gamaredon's destructive option has moved from anti-analysis trick to operational tool.
Timeline
-
original reporting
Gamaredon APT Launches Fileless Campaign Against Ukraine — GammaWorm Uses NTFS ADS, Cloud Dead-Drop C2
cyberpress.org · 134d ago · June 2nd, 2026
Sekoia.io published a reconstruction of an active Gamaredon (FSB-linked) campaign targeting Ukrainian government, military, and critical infrastructure. The infection chain is nearly entirely fileless:
-
Initial access via weaponized XHTML using CVE-2025-8088 (WinRAR path traversal, patched in 7.13) to extract a hidden HTA to Windows Startup
-
GammaPhish stage delivers GammaLoad modular loader via Supabase cloud infrastructure with fake BBC authentication prefix
-
GammaWorm (20,000+ lines obfuscated VBScript) stores modules in NTFS Alternate Data Streams — invisible to standard directory listings — and uses Telegram, Telegra.ph, Teletype.in, and Cloudflare Workers as dead-drop resolvers for C2
-
GammaSteel PowerShell stealer encrypts 71 modules in Windows registry via DPAPI, exfiltrates to S3-compatible storage
Sekoia recommends full system wipe as remediation due to Gamaredon's rapid malware iteration and DDR-based persistence.
-
-
update from win-rar.com
WinRAR 7.13 Final released
win-rar.com · 441d ago · July 30th, 2025
RARLAB's release notes for WinRAR 7.13, dated July 30, 2025, list CVE-2025-8088 as a critical directory traversal vulnerability in the Windows versions of WinRAR, RAR, UnRAR, UnRAR.dll, and portable UnRAR, letting crafted archives bypass the user-specified extraction path and write to unintended locations. Linux/Unix builds and RAR for Android are not affected. RARLAB credits Anton Cherepanov, Peter Kosinar, and Peter Strycek of ESET for the report; the page notes the release notes were updated on August 12, 2025.
-
update from nvd.nist.gov
CVE-2025-8088
nvd.nist.gov · 431d ago · August 8th, 2025
NVD published CVE-2025-8088 on August 8, 2025: a path traversal vulnerability in the Windows version of WinRAR that allows arbitrary code execution via maliciously crafted archive files. The record marks the vulnerability as exploited in the wild and credits discovery to Anton Cherepanov, Peter Kosinar, and Peter Strycek of ESET.
-
update from welivesecurity.com
Update WinRAR tools now: RomCom and others exploiting zero-day vulnerability
welivesecurity.com · 429d ago · August 11th, 2025
ESET researchers Anton Cherepanov, Peter Strycek, and Damien Schaeffer disclosed that CVE-2025-8088, a zero-day path traversal in WinRAR that abuses alternate data streams, was exploited in the wild starting July 18, 2025. WinRAR 7.13 beta 1 shipped July 24, 2025 and final 7.13 on July 30, 2025. Russia-aligned RomCom delivered SnipBot, RustyClaw, and Mythic agent backdoors through CV-themed RAR lures aimed at financial, manufacturing, defense, and logistics organizations in Europe and Canada between July 18 and 21, 2025, and ESET noted a second exploiting actor whose research was independently published by BI.ZONE.
-
update from cisa.gov
RARLAB WinRAR Path Traversal Vulnerability (CISA Known Exploited Vulnerabilities catalog)
cisa.gov · 428d ago · August 12th, 2025
CISA added CVE-2025-8088 to the Known Exploited Vulnerabilities catalog on August 12, 2025 with a federal remediation due date of September 2, 2025.
-
update from arstechnica.com
High-severity WinRAR 0-day exploited for weeks by 2 groups
arstechnica.com · 428d ago · August 12th, 2025
Ars Technica reported that the high-severity WinRAR zero-day had been exploited for weeks by two distinct groups. The piece noted the exploits allow persistent backdooring when targets open a booby-trapped archive.
-
update from sekoia.com
FSB's matryoshka #1/3 - Gamaredon's gifts that keeps unpacking - GammaPhish and GammaWorm
sekoia.com · 135d ago · June 1st, 2026
Sekoia's TDR team published part one of its FSB Matryoshka series on June 1, 2026, reconstructing a January 2026 Gamaredon infection chain that begins with weaponized XHTML smuggling a RAR exploiting CVE-2025-8088 to drop an HTA into the Windows Startup folder. The article also cites Google Threat Intelligence Group reporting exploitation of the same vulnerability by Sandworm, Turla, Gamaredon, and China-nexus intrusion sets.