20260602-thehackernews.com-ec1ca | Perceptive Security

< Back to index

Gamaredon Exploits WinRAR to Deliver GammaWorm and GammaSteel Against Ukraine

Published:

2 June 2026 at 18:21:49

Alert date:

2 June 2026 at 19:00:51

Source:

thehackernews.com

Ransomware & Malware, Data Breach & Exfiltration, Critical Infrastructure

Russian hacking group Gamaredon continues exploiting CVE-2025-8088, a path traversal vulnerability in WinRAR, to deliver multiple malware families including GammaWorm and GammaSteel against Ukrainian targets. The campaign uses weaponized WinRAR archives to deploy an HTML Application payload called GammaPhish, which serves as an initial foothold for data theft and lateral movement operations.

Technical details

Gamaredon exploits CVE-2025-8088, a path traversal vulnerability in WinRAR, to deliver GammaPhish HTML Application payload. GammaPhish retrieves GammaLoad VBScript downloader which fingerprints hosts and updates network configuration using dead drop resolvers. GammaWorm establishes persistence via scheduled tasks, hides legitimate directories on network shares and USB drives, replaces them with malicious LNK files. It uses Telegram channels for C2 communication via curl GET requests and employs NTFS Alternate Data Streams to hide core modules. GammaSteel is a modular information stealer that captures files with specific extensions and exfiltrates to AWS S3 buckets or attacker servers.

Mitigation steps:

Monitor for suspicious HTA files, VBScript payloads, and malicious LNK files. Watch for NTFS Alternate Data Streams usage for hiding malware modules. Monitor network traffic to Telegram channels and AWS S3 buckets. Implement detection for scheduled task creation and USB drive activity. Update WinRAR and Microsoft Office to latest versions to patch known vulnerabilities.

Affected products:

WinRAR
Microsoft Office

Related CVE's:

CVE-2025-8088

CVE-2026-21509

Related threat actors:

IOC's:

HTML Application (HTA) files, VBScript payloads, Windows Shortcut (LNK) files, NTFS Alternate Data Streams usage, Telegram channels for C2, AWS S3 bucket exfiltration, COVENANT Grunt implant, PixyNetLoader malware

This article was created with the assistance of AI technology by Perceptive.