Security researchers at Sekoia say a Russian government hacking group has been running an active campaign against Ukraine using a chain of malware where, in the team's words, every stage doubles as a backdoor. That design makes the intrusion hard to fully remove: even if defenders clean one component, another can quietly reinstall the rest. The group, Gamaredon, has been tied by Ukraine's security service to the Russian Federal Security Service (FSB), and the campaign continues to target government, military, and critical-infrastructure organizations in Ukraine.
What's affected
The targets are Ukrainian organizations running Windows. The first foothold relies on a flaw in WinRAR, the popular file-compression tool, tracked as CVE-2025-8088. It is a path-traversal bug that lets a booby-trapped RAR archive write a hidden file into a location it should not reach. Anyone using an unpatched copy of WinRAR who opens one of these archives is at risk.
How the attack works
Sekoia's Threat Detection & Research (TDR) team, with author Amaury G., laid out the full chain in a three-part report titled FSB's matryoshka, Gamaredon's gifts that keep unpacking, named for the nested Russian dolls because each tool hides another inside it. The breakdown spans part one (GammaPhish and GammaWorm), part two (GammaLoad), and part three (GammaSteel).
It starts with GammaPhish, malicious web files that show a fake "DOCUMENT DOWNLOADED" message while quietly delivering a RAR archive and pinging the attackers to confirm the victim took the bait. The archive abuses the WinRAR flaw to drop a hidden script into the Windows Startup folder, so it runs automatically at the next login via mshta.exe. The download links use a trick where a trusted-looking name is glued to the front of the real address (for example hxxps://www.bbc.com@iiwdsxwamylbwwsoyrmj.supabase[.]co/...), so the visible part looks legitimate.
Next comes GammaWorm, a sprawling VBScript worm of more than 20,000 lines that hides without leaving normal files on disk. It tucks copies of itself into NTFS Alternate Data Streams (a hidden part of the file system), sets scheduled tasks to relaunch every seven to ten minutes, and edits the registry to stay out of sight. It spreads by swapping folders on USB sticks and network drives for malicious shortcuts dressed up with Ukrainian-language lures. For instructions, it hides command-and-control (C2) details on legitimate sites such as Telegram, Telegra.ph, and Teletype, a technique called Dead Drop Resolvers, then runs whatever code the attackers send back.
GammaLoad is a durable loader that runs almost entirely in memory, caches its C2 settings in the HKCU\Console registry key, and sets a scheduled task firing every eleven minutes. It hides instructions on Telegraph, Telegram, and Check-Host, and routes traffic through Cloudflare Workers and trycloudflare tunnels, layering Base64, ROT13, and XOR to dodge analysis.
The final layer, GammaSteel, hunts for office documents, archives, and PDFs and steals them. Sekoia flags a technique it had not seen from Gamaredon before: the stealer hides 71 PowerShell functions, encrypted with the Windows Data Protection API (DPAPI), inside the HKCU\Printers registry area, tying decryption to the victim's own login and running only from memory. It grabs files three ways at once (hourly drive scans, watching for USB insertions, and real-time monitoring) and sends them out to S3-compatible storage at Tebi.io, with a fallback that also opens a backdoor. Sekoia notes the DPAPI trick overlaps with older tradecraft tied to InvisiMole, hinting at tool-sharing among FSB-linked groups.
Why it matters
This activity lines up with established Gamaredon tradecraft: heavy on VBScript, modular, and loud in volume but quiet in technique. Sekoia watched the operators spin up four or more new servers per day, a pace that lets them shrug off takedowns and rotate indicators faster than signature-based defenses can react. The backdoor-at-every-stage design means cleanup is rarely finished after one pass.
What you should do
Patch WinRAR against CVE-2025-8088 and block or closely monitor removable-media autorun, which closes two of the chain's main entry points. Defenders should also hunt for VBScript launching from Alternate Data Streams, scheduled tasks firing on tight seven-to-eleven-minute intervals, unusual DPAPI activity writing to HKCU\Printers, registry C2 caches under HKCU\Console, and outbound traffic to trycloudflare tunnels and the dead-drop platforms above.
Selected indicators of compromise
Sekoia published extensive indicators across the three reports; a defanged selection follows (re-arm only in controlled environments):
- GammaPhish (MD5):
1794369214b7f62e70a0485e61335c61 - GammaWorm (MD5):
8e1624d110c090ff57d4b493a9107c66; C2104.194.140[.]6,quitethepastry[.]ru; DDRhxxps://telegra[.]ph/f8bfl6sp-01-02,hxxps://www.telegram[.]me/s/oberfarir; trackingiiwdsxwamylbwwsoyrmj.supabase[.]co - GammaLoad (MD5):
bf94f4056627907d86ce1cae8b44c67a,a2c6e01001c62f6198e31a9d603977c6,d2a6009587b3cb73355c2d1e53d5cdfa; C2hxxps://insight-sweet-drainage-appreciated.trycloudflare[.]com/log,172.86.76[.]132 - GammaSteel: C2
justsstop[.]ru,165.22.170[.]129; exfils3.tebi[.]io; DDR Mastodon@6o786d68hu,hxxps://rentry[.]co/hwzrmfkx,hxxps://write[.]as/api/posts/1nei1af6dnw8q
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.