# Russian Gamaredon Group Wages Intensifying Campaign Against Ukraine Using WinRAR Flaw and Trio of Malware Families


Sekoia has attributed ongoing cyberattacks against Ukrainian targets to Gamaredon, a Russian state-aligned threat actor, documenting a sophisticated campaign that chains together a previously unpatched WinRAR vulnerability, phishing payloads, and three distinct malware families designed for data exfiltration and lateral movement. The attackers exploit CVE-2025-8088, a critical path traversal flaw in WinRAR, to establish initial footholds and deliver GammaPhish (an HTML Application-based phishing framework), GammaWorm (a reconnaissance and data-gathering trojan), and GammaSteel (a module designed for secondary payload delivery and persistence).


## The Threat


Gamaredon's latest campaign represents a direct escalation in targeting Ukrainian government, military, and critical infrastructure organizations. The attack chain begins with spear-phishing emails containing specially crafted WinRAR archives that exploit CVE-2025-8088 without requiring user interaction beyond standard file extraction.


Attack flow:

1. Victim receives phishing email with malicious RAR archive

2. WinRAR's path traversal vulnerability allows arbitrary file placement

3. GammaPhish HTML application is silently extracted to startup folders

4. Upon reboot or next logon, GammaPhish executes and fetches secondary payloads

5. GammaWorm establishes reconnaissance and data exfiltration capabilities

6. GammaSteel enables further lateral movement and modular malware deployment


The campaign is currently active and ongoing, with new variants detected regularly over the past 90 days.


## Background and Context


### Who is Gamaredon?


Gamaredon (also tracked as Primitive Bear, ACTINIUM, and Callisto Green by various security firms) is a Russia-based APT group with strong ties to Russian federal security services. Since at least 2014, the group has focused almost exclusively on Ukrainian government and military targets, making it one of the longest-running, most consistent threats to Ukraine's institutional cybersecurity.


The group is known for:

  • Persistent espionage campaigns lasting years
  • Custom malware development tailored to Ukrainian infrastructure
  • Heavy use of Ukrainian language in command-and-control infrastructure
  • Operational tempo that correlates with real-world military and political events in Eastern Europe

    • ### The WinRAR Vulnerability (CVE-2025-8088)


    WinRAR, the widely-used file compression utility with millions of installations globally, contains a critical path traversal vulnerability that allows attackers to write files to arbitrary locations on a victim's system. When a specially crafted RAR archive is extracted, the flaw permits:


  • Arbitrary file placement outside the intended extraction directory
  • Overwriting system files or placing malware in auto-startup locations
  • No user warnings or obvious indicators of suspicious activity

    • The vulnerability affects WinRAR versions prior to 6.24 and has been exploited in the wild since late 2024. While WinRAR has released patches, many organizations and individual users remain unpatched, providing Gamaredon with a reliable attack vector.


    ## The Malware Arsenal


    ### GammaPhish


    GammaPhish is an HTML Application (HTA) loader that serves as the initial post-exploitation foothold. Key characteristics:


  • Packaged as an innocent-looking document or system utility
  • Executes within the context of Windows Script Host (WScript.exe)
  • Communicates with command-and-control servers to retrieve additional payloads
  • Often disguised as legitimate Windows system files or Microsoft Office documents
  • Difficult to detect with traditional signature-based antivirus

    • C2 Infrastructure: Sekoia identified that GammaPhish phones home to IP addresses and domains registered in Eastern Europe, with several associated with previously identified Gamaredon infrastructure.


    ### GammaWorm


    GammaWorm is a full-featured reconnaissance and exfiltration trojan designed to gather intelligence before lateral movement occurs. Capabilities include:


    | Function | Purpose |

    |----------|---------|

    | Credential harvesting | Extracts cached credentials from browser, email clients, Windows Credential Manager |

    | File enumeration | Catalogs documents, spreadsheets, and files matching criteria (keywords: "secret," "classified," "order," etc.) |

    | Network mapping | Queries Active Directory, identifies internal network topology |

    | Process monitoring | Observes running applications to identify business processes and tool usage |

    | Clipboard theft | Captures copied text, including passwords and URLs |

    | Screenshot capture | Periodic system screenshots for situational awareness |


    Data is compressed and exfiltrated to attacker-controlled servers via encrypted channels. Forensic analysis suggests the malware can remain dormant for weeks, observing before transmitting stolen data in bulk.


    ### GammaSteel


    GammaSteel functions as a modular malware loader and persistence mechanism. It downloads and executes additional payloads (ransomware, wiper malware, or additional trojans) based on attacker directives. The malware:


  • Maintains multiple persistence mechanisms (registry modifications, scheduled tasks, WMI subscriptions)
  • Patches local Windows Firewall rules to allow C2 communication
  • Can disable Windows Defender or EDR agents if detected
  • Updates itself automatically from C2 servers

    • ## Technical Details of the Attack Chain


    The complete exploitation flow demonstrates sophisticated understanding of Windows security architecture:


    1. Delivery: Spear-phishing email targets Ukrainian officials with subject lines in Ukrainian, often referencing current events or impersonating known government contacts.


    2. Exploitation: The RAR archive's manifest is crafted to place GammaPhish at C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\svchost_util.hta — exploiting CVE-2025-8088's path traversal flaw.


    3. Persistence: Windows automatically executes HTA files in the Startup folder at the next user logon, no UAC prompt required.


    4. Staging: GammaPhish connects to a hardcoded C2 server and downloads GammaWorm and GammaSteel.


    5. Exfiltration: GammaWorm begins passive data collection; after 2-4 weeks of intelligence gathering, GammaSteel is activated for lateral movement.


    6. Lateral Movement: Using harvested credentials and network topology data, attackers move to high-value systems (file servers, backup appliances, domain controllers).


    ## Implications for Organizations


    ### Immediate Risk


    Organizations with Ukrainian employees, operations, or supply chain connections face elevated exposure. Additionally, any organization using unpatched WinRAR (versions before 6.24) is vulnerable to the initial infection vector, regardless of geographic location.


    ### Broader Concerns


    This campaign illustrates a persistent trend:


  • Nation-state groups increasingly exploit commodity software vulnerabilities previously considered low-risk
  • Supply chain targeting is evolving — Ukraine itself is a testing ground for techniques later deployed against NATO allies
  • HTA-based loaders remain effective because they're built into Windows and often whitelisted by legacy security tools

    • ### Affected Sectors


  • Government and military organizations
  • Defense contractors
  • Critical infrastructure (energy, water, telecommunications)
  • NGOs and humanitarian organizations operating in Eastern Europe
  • Cybersecurity firms supporting Ukrainian defenses

    • ## Recommendations


    For Organizations:


  • Patch WinRAR immediately to version 6.24 or later; consider deploying patches via MDM/GPO for uniformity
  • Disable HTA file execution via Group Policy if not required: Computer Configuration > Administrative Templates > Windows Components > Internet Explorer > Security Features > MIME Handling
  • Monitor for GammaPhish indicators: Watch for svchost*.hta, Windows\Start Menu\Programs\Startup for suspicious files, and network connections to Eastern European IPs
  • Implement application whitelisting to prevent unsigned HTA execution
  • Conduct threat hunting for lateral movement patterns consistent with GammaWorm reconnaissance (LDAP queries to Active Directory, large file enumeration, credential access)

    • For Ukrainian Government and Critical Infrastructure:


  • Treat this as priority one — these are directed, persistent threats
  • Increase monitoring of credential usage and anomalous logons
  • Segment networks to contain lateral movement
  • Preserve forensic evidence from any suspected Gamaredon intrusions for attribution and future prosecution

    • For Security Teams:


  • Update detection signatures for GammaPhish (common file names: svchost_util.hta, explorer_backup.hta)
  • Monitor EDR for suspicious HTA execution with Windows Script Host parent processes
  • Track C2 domains identified by Sekoia through threat intelligence sharing

    • ---


    ## HackWire Analysis


    This campaign exemplifies the shifting nature of state-sponsored cyber warfare. Gamaredon has operated for over a decade with laser focus on Ukraine — and the group's methodical evolution toward exploiting unpatched software vulnerabilities in legitimate tools suggests Russian operators are adapting to mature Ukrainian cybersecurity defenses. Rather than deploying zero-day exploits (expensive, politically risky), Gamaredon now weaponizes publicly known flaws in widely used software, creating a lower-cost, high-impact attack surface.


    What's particularly significant: the three-tier malware stack (GammaPhish → GammaWorm → GammaSteel) indicates operational patience. This isn't ransomware-as-a-service designed to move fast and destroy. This is espionage designed to observe, understand, and exfiltrate *before* the victim knows they're compromised. For Ukrainian defenders, this means the infection may have already occurred weeks ago; the WinRAR flaw is simply the delivery mechanism we're *now* detecting.


    The broader risk: WinRAR is installed on millions of machines worldwide. While Gamaredon's current focus is Ukraine, the vulnerability is exploitable everywhere. Any organization using unpatched WinRAR should treat this as a critical patch, not a "nice to have." Gamaredon's success against hardened Ukrainian targets means their techniques work against sophisticated defenders — and are likely being studied by other Russian intelligence services for adaptation against NATO allied targets.


    The message is clear: patching is no longer optional. It's warfare. — *HackWire Editorial*


    ---


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)