Back Thehackernews

Gamaredon Exploits WinRAR to Deliver GammaWorm and GammaSteel Against Ukraine

Thehackernews •[email protected] (The Hacker News) • June 2, 2026

The Russian hacking group known as Gamaredon has been attributed to the continued exploitation of a WinRAR vulnerability to deliver multiple malware families aimed at data theft and propagation.

Per Sekoia, the activity involves the weaponization of CVE-2025-8088, a path traversal flaw in WinRAR, to launch an HTML Application payload dubbed GammaPhish, which is then used to retrieve an

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Gamaredon Exploits WinRAR Vulnerability in Ongoing Ukraine Campaign Gamaredon, a Russian state-backed APT group, is actively exploiting a WinRAR vulnerability (CVE-2025-8088) to deploy malware against Ukrainian government and military targets. The attack begins with a spearphishing email containing a malicious HTML Application payload known as GammaPhish, which retrieves a VBScript downloader called GammaLoad. This downloader fetches the GammaWorm, a self-propagating worm that hides its components in NTFS Alternate Data Streams, allowing it to evade detection. The malware uses legitimate services like Telegram and Cloudflare for command-and-control operations. The campaign has been ongoing since at least January 2026, with a focus on long-term access to critical infrastructure. Sekoia's analysis indicates that the safest remediation is a full system rebuild due to the malware's ability to continuously fetch new payloads. Organizations are advised to update WinRAR and implement strict scanning controls on email attachments. 7 sources 80

Extracted Entities

Gamaredon Exploits WinRAR to Deliver GammaWorm and GammaSteel Against Ukraine

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Campaigns (1)

Countries (1)

CVEs (1)

CWE Weaknesses (1)

Malware (2)

Tools (1)