Gamaredon APT Abuses Windows Features and Cloud for Malware Distribution

Key Takeaways

• The Russian state-sponsored APT group Gamaredon has launched a new campaign targeting Ukrainian entities.
• The group is deploying a sophisticated VBScript worm, “GammaWorm,” which leverages native Windows features like NTFS Alternate Data Streams (ADS) for stealth and persistence.
• The campaign exploits a WinRAR vulnerability (CVE‑2025‑8088) and utilizes popular cloud services and messaging platforms for resilient command-and-control (C2) infrastructure.
• Targets include Ukrainian government, military, and critical infrastructure, indicating a continued focus on espionage.

A new, highly sophisticated campaign by the Russian state-backed advanced persistent threat (APT) group Gamaredon is actively targeting Ukrainian organizations. The operation employs a novel VBScript worm designed to exploit legitimate Windows functionalities for covert operations and leverage mainstream cloud services for robust command-and-control (C2) communications.

This latest offensive highlights Gamaredon’s refined approach, featuring a modular toolset engineered for enhanced stealth, resilience, and sustained access to compromised networks.

Analysts observe that Gamaredon has restructured its malicious arsenal into a cohesive “Gamma” ecosystem. This includes specialized components such as GammaPhish for initial compromise, GammaLoad for staging, GammaWorm for propagation, and GammaSteel for data exfiltration.

The attack chain typically commences with weaponized xHTML lures. These lures deliver a malicious RAR archive that exploits CVE‑2025‑8088 in WinRAR, enabling code execution from Windows Startup folders without alerting the user.

Once activated, the VBScript-based infection sequence deliberately avoids traditional executable files. Instead, it deploys a multi-stage script architecture, where each stage can independently retrieve and execute subsequent payloads from remote infrastructure.

Gamaredon’s Advanced Malware and Cloud C2

This architectural design effectively transforms each stage of the infection into a standalone backdoor. Every component possesses the capability to profile the victim’s system, update its configuration, and deploy new malware on demand.

This inherent redundancy means that even if defenders manage to remove portions of the infection chain, surviving components retain sufficient capabilities to re-establish access, rendering partial remediation efforts largely ineffective.

At the core of this updated toolset is GammaWorm, a substantial VBScript implementation that primarily resides within NTFS Alternate Data Streams (ADS)—an often-overlooked feature of the Windows file system. Rather than creating visible files, GammaWorm stores its modules within ADS attached to existing user profile paths. This technique ensures that directory listings and file sizes appear normal, significantly reducing the likelihood of detection.

For persistence, the worm creates RunOnce registry entries and scheduled tasks. These mechanisms execute code directly from the hidden ADS, while simultaneously modifying Windows Explorer settings to hide file extensions and protected system files, further obscuring its presence.

Following its installation, GammaWorm actively propagates across USB and network drives. It achieves this by copying itself to target locations and then concealing legitimate folders, replacing them with malicious LNK shortcuts. These shortcuts are designed to both open the expected directory and silently execute the worm via mshta.exe and wscript.exe.

To accelerate its spread, GammaWorm also generates decoy shortcuts with enticing Ukrainian-language filenames, designed to trick users into clicking them and inadvertently spreading the malware across shared media.

Concurrently, GammaWorm maintains a continuous loop that functions as a stealthy backdoor. It regularly contacts its C2 infrastructure to exfiltrate system fingerprints and retrieve new VBScript payloads for in-memory execution. Host data is encoded into randomized HTTP headers to blend in with normal web traffic, evading detection.

Gamaredon further enhances these fileless techniques by exploiting legitimate cloud and messaging platforms for its C2 management.

GammaWorm resolves live servers through “Dead Drop Resolvers” hosted on services such as Telegraph/Teletype via graph.org, Cloudflare Workers subdomains, and S3-compatible storage. Each discovered URL is stored in dedicated registry keys, which are later accessed to retrieve current C2 endpoints.

The group also leverages public Telegram channels as dead drops, using curl.exe to pull HTML and parse embedded IP addresses that function as active C2 nodes.

This hybrid C2 design provides rapid domain rotation capabilities, allows for the concealment of staging servers behind Cloudflare tunnels, and offers seamless fallback to direct IP addresses if cloud services are disrupted.

In a report shared with Cyber Security News, SEKOIA stated that the ongoing campaign remains focused on Ukrainian government, military, and critical infrastructure networks. This reinforces the established links between Gamaredon and Russia’s Federal Security Service.

By integrating fileless VBScript chains, ADS-based concealment, USB-borne propagation, and cloud-backed C2, the group has significantly enhanced the stealth and persistence of its espionage operations compared to its previous frameworks.

What You Should Do

• Ensure all systems, especially WinRAR installations, are patched to the latest versions to mitigate known vulnerabilities like CVE‑2025‑8088.
• Implement robust endpoint detection and response (EDR) solutions capable of detecting script-based attacks, anomalous process execution (e.g., mshta.exe, wscript.exe), and suspicious network traffic patterns.
• Educate users about phishing tactics, the dangers of opening suspicious attachments, and the risks associated with clicking unknown links or using untrusted USB drives.
• Monitor network traffic for connections to known malicious C2 infrastructure and unusual activity involving cloud services or messaging platforms.
• Disable or restrict the use of NTFS Alternate Data Streams (ADS) where possible, and implement tools that can scan for and detect hidden data within ADS.
• Regularly back up critical data and test recovery procedures to minimize the impact of a successful compromise.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.