Gamaredon APT Hides Malware in Windows Features and Abuses Cloud Platforms for C2

Cybersecuritynews •Abinaya • June 2, 2026

Gamaredon, a Russian state-backed espionage group, is deploying a new VBScript worm that hides inside native Windows features while using popular cloud services as covert command-and-control (C2) channels in an ongoing campaign against Ukrainian targets. The operation showcases a modular toolset built for stealth, resilience and long-term access. In this campaign, Gamaredon has reorganized its […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Gamaredon Exploits WinRAR Vulnerability in Ongoing Ukraine Campaign Gamaredon, a Russian state-backed APT group, is actively exploiting a WinRAR vulnerability (CVE-2025-8088) to deploy malware against Ukrainian government and military targets. The attack begins with a spearphishing email containing a malicious HTML Application payload known as GammaPhish, which retrieves a VBScript downloader called GammaLoad. This downloader fetches the GammaWorm, a self-propagating worm that hides its components in NTFS Alternate Data Streams, allowing it to evade detection. The malware uses legitimate services like Telegram and Cloudflare for command-and-control operations. The campaign has been ongoing since at least January 2026, with a focus on long-term access to critical infrastructure. Sekoia's analysis indicates that the safest remediation is a full system rebuild due to the malware's ability to continuously fetch new payloads. Organizations are advised to update WinRAR and implement strict scanning controls on email attachments. 7 sources 80

Extracted Entities

Gamaredon APT Hides Malware in Windows Features and Abuses Cloud Platforms for C2

The full story

Extracted Entities

APT Groups (1)

Attack Types (2)

MITRE ATT&CK (2)

Platforms (1)

Tools (1)