Gamaredon Exploits WinRAR to Deliver Gamma Worm and Gamma Steel Against Ukraine
Summary: Sekoia observed in January 2026 that Gamaredon, a Russian state-sponsored group linked to the FSB, exploited the WinRAR path traversal flaw CVE-2025-8088 to deliver an HTA payload called GammaPhish, which retrieves VBScript downloaders codenamed GammaLoad. Those downloaders push a worm, GammaWorm, that persists via scheduled tasks, hides directories on network shares and USB drives behind malicious LNK files, resolves its command-and-control through a hard-coded public Telegram channel, and conceals modules in NTFS Alternate Data Streams, alongside an information stealer, GammaSteel, that exfiltrates files to an AWS S3 bucket.
What you should know: Gamaredon targets Ukrainian government, military, and critical infrastructure entities, and GammaWorm's use of a legitimate Telegram channel for command-and-control is designed to blend with normal traffic and sustain long-term espionage. Sekoia assesses with high confidence that the modular architecture will be reused, so the same chain could carry other payloads such as GammaWipe depending on the operator's objectives.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-8088CVE-2026-21509
- Related
- CVE-2026-21509: Microsoft Office Security Feature Bypass Vulnerability Known Exploited Vulnerabilities · Jan 26, 2026CVE-2025-8088: RARLAB WinRAR Path Traversal Vulnerability Known Exploited Vulnerabilities · Aug 12, 2025