An active Gamaredon campaign targeting Ukrainian government, military, and critical infrastructure entities is revealing a sophisticated, nearly entirely fileless infection chain built around native Windows features and legitimate cloud services, according to new findings published by Sekoia.io.
The Russia-linked APT, officially attributed to the FSB and also tracked as ACTINIUM, Armageddon, and UAC-0010, was identified in January 2026 through a YARA-based hunting operation.
By combining their initial findings with over 70 forensic artifacts retrieved from compromised hosts, researchers successfully reconstructed a significant portion of the group’s ongoing infection chain.
The attack begins with a weaponized XHTML file, likely delivered via spearphishing, that uses HTML Smuggling to drop a malicious RAR archive on the victim’s machine, Sekoia said.
The archive exploits CVE-2025-8088, a critical path traversal vulnerability in WinRAR versions prior to 7.13, to silently extract a hidden HTA file directly into the user’s Windows Startup directory ensuring execution on the next login without any additional user interaction.
APT Hides Malware in Windows Features
The HTA file then calls mshta.exe with a remote payload hosted on Supabase infrastructure, disguising the request with a fake www.bbc.com authentication prefix to deceive casual inspection.
This stage, classified as GammaPhish, delivers the group’s modular loader family, GammaLoad, which fingerprints the host and downloads further payloads via cascading VBScript stages.
The most technically advanced component uncovered is GammaWorm, a VBScript-based worm exceeding 20,000 lines of obfuscated code.
Its standout capability is the abuse of NTFS Alternate Data Streams (ADS), a native Windows feature originally designed for Macintosh file system compatibility, to store and execute its core modules entirely out of sight of standard directory listings.
GammaWorm writes distinct modules into hidden streams such as %USERPROFILE%:GTR, :URL, :LNK, and :SERVER, which are then triggered by three scheduled tasks masquerading as legitimate Windows maintenance processes: DiskDiagnosticDataCollector, SilentCleanup, and SmartRetry.
For propagation, the worm targets USB and network drives, hiding legitimate folders and replacing them with malicious LNK shortcut files bearing Ukrainian-language social-engineering filenames, including lures for military and government documents, to trick victims into executing the worm.
GammaWorm resolves its C2 infrastructure using Dead Drop Resolvers (DDRs) publicly accessible pages hosted on Telegram, Telegra.ph, Teletype.in, and Cloudflare Workers to retrieve live server addresses and store them directly in Windows registry keys under HKCU\Console\.
This hybrid model blends legitimate platforms with operator-controlled domains, making network-based detection significantly harder.
The worm operates in an infinite loop, sending POST requests with host fingerprint data embedded in randomized HTTP headers rather than the request body, a deliberate evasion tactic.
Depending on the server’s HTTP response code, it either executes fresh VBScript payloads in memory or updates its C2 configuration on the fly.
Sekoia researchers also acquired the latest version of GammaSteel, a modular PowerShell-based stealer that stages itself entirely within the Windows registry across 71 encrypted modules protected by Windows DPAPI.
It exfiltrates targeted documents, including files from newly inserted USB drives, to S3-compatible cloud storage, with fallback to operator-controlled C2 servers.
Indicators of Compromise
| Indicator | Type | Description |
|---|---|---|
iiwdsxwamylbwwsoyrmj.supabase[.]co | Domain | GammaPhish tracking & C2 |
1794369214b7f62e70a0485e61335c61 | MD5 | GammaPhish xHTML sample |
8e1624d110c090ff57d4b493a9107c66 | MD5 | GammaWorm (~.gif) |
quitethepastry[.]ru | Domain | GammaWorm C2 |
104.194.140[.]6 | IP | GammaWorm C2 |
graph[.]org/kyjfkyr-12-06 | URL | Dead Drop Resolver |
hxxps://t[.]me/s/oberfarir | URL | Telegram DDR channel |
efficiency-planes-emotions-fascinating.trycloudflare[.]com | Domain | GammaWorm C2 (Cloudflare) |
bold.zsjtn41091.workers[.]dev | Domain | GammaWorm DDR (Cloudflare) |
teletype[.]in/@myrain/Xh1Lta2Ccro | URL | Dead Drop Resolver |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Sekoia.io notes that due to Gamaredon’s rapid malware iteration and DDR-based persistence, a full system wipe is the recommended remediation for any compromised host.
Defenders should hunt for ADS creation under %USERPROFILE%, monitor the HKCU\Console\ registry hive, and alert on wscript.exe executing paths containing colons not followed by a backslash.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
