Gamaredon (UAC-0010) Sustains 12-Wave Phishing Campaign Against Ukraine — GammaDrop/GammaLoad Deployers

HarfangLab's report TRR260501, published May 13, 2026, catalogues a dozen waves of Gamaredon (UAC-0010) spearphishing against Ukrainian state institutions from September 26, 2025 through late April 2026, plus three more waves on May 5, 7, and 8, 2026, with the Security Service of Ukraine's regional directorates in Luhansk, Lviv, and Chernivtsi the most frequent targets. Each email carries an archive exploiting CVE-2025-8088, the WinRAR directory traversal flaw in Windows builds up to 7.12, patched in 7.13 on July 30, 2025. An NTFS alternate data stream inside the archive holds the GammaDrop VBScript, and the traversal sequence embedded in the stream name writes it into the Startup folder. GammaDrop pulls GammaLoad, an HTA executed through mshta.exe in a hidden window, from Cloudflare Workers infrastructure; GammaLoad drops casto0O.icl to %TEMP%, establishes a RunOnce key named integralXk3, and beacons computer name and volume serial number inside the User-Agent every 3.5 minutes.

The exploit itself is old news, and that is the argument. CVE-2025-8088 has been on CISA's KEV catalog since August 12, 2025, was RomCom's weapon in July 2025, and requires nothing but an unpatched WinRAR and one user opening an attachment; persistence never leaves user context. What keeps this campaign succeeding nine months in is mail authentication failure on the victim side: HarfangLab traced a spoofed prosecutor general email delivered through ukr.net because gp.gov.ua set DMARC to quarantine instead of reject, scoring X-Ukrnet-Yellow: 64 yet still arriving, and a hijacked parked domain, joymobile.com.ua, whose MX and SPF records the attacker added through a compromised registrar account, yielding clean SPF and DKIM passes. One relay IP, 194.58.66.53, recurs across four months of samples. A group running auto-generated, per-wave tooling on a roughly monthly cadence defeats hash-based detection without any technical sophistication, so this is a governance failure with a long success record, not a zero-day story.

Patch or remove WinRAR everywhere; 7.13 or later closes CVE-2025-8088, and the May waves switched to ARJ archives renamed .rar or .zip, so filtering on archive type alone is insufficient. Set DMARC to p=reject on every domain that sends as you, since SPF and DKIM validated the attacker's relay rather than the From: header. Block 194.58.66.0/24 at the mail boundary. Hunt for .vbs or .hta files appearing under %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\, the RunOnce value integralXk3, %TEMP%\brushedGpI.hta, and wscript.exe or mshta.exe fetching .workers.dev or .trycloudflare.com URLs. On the wire, look for GETs at 3.5-minute intervals to workers.dev hosts using random extensions like .cfl, .fits, .mov, .fff, or .icm, with User-Agents appending ::COMPUTERNAME_SERIAL::/.v delimiters, later variants swapping in Safari, Bingbot, or Google AdsBot strings with ;; separators. Known C2 includes throbsuns2.h4puonhajw.workers.dev, a.cnbyvilkghx2a6p.workers.dev, kosoyed.ru, and rubakovox.pro; HarfangLab publishes matching SHA-256 indicators, for example GammaDrop 62818ae5e305b89b9461536dac1b9daf4cebd99d24e417357e27e2ae4582a704, in its GitHub repository.

Two developments would move this assessment. A fourth archive format or a fresh loader variant would confirm the monthly cadence is still running and reset detection content again, as the ARJ shift did on May 5, 2026. And any movement by Ukrainian institutions toward DMARC p=reject, the single control HarfangLab identifies as decisive, would push Gamaredon onto compromised internal accounts for delivery, which is quieter, harder to filter, and a signal that cheap spoofing against these targets has stopped working.