Gamaredon, a Russian state-backed APT group, continues to run long-term espionage operations against Ukrainian government institutions, military bodies, and critical infrastructure. Its modular infection chain begins with a spearphishing document, abuses a WinRAR path traversal flaw, and then relies on VBScript, alternate data streams, and dead-drop resolvers to spread, persist, and retrieve additional payloads. The campaign also makes use of legitimate services such as Telegram, Cloudflare, and Supabase for command-and-control activity. Detection remains challenging because the attackers heavily abuse built-in Windows functionality and fileless execution methods.
Sekoia TDR reconstructed the January 2026 intrusion chain by examining more than 70 artifacts collected from compromised systems. Their analysis identified the initial phishing component, GammaPhish, followed by the VBScript loader GammaLoad, the self-propagating worm GammaWorm, and the PowerShell stealer GammaSteel, which stores modules in the registry. Researchers also documented GammaWorm’s use of alternate data streams and scheduled tasks for persistence, along with repeated network requests to multiple dead-drop resolver domains. The investigation mapped how each component supported the broader infection chain and long-term foothold.
Because the malware can continuously fetch new payloads through dead-drop resolvers, the safest remediation approach is often a full system rebuild. Defensive efforts should focus on detecting suspicious alternate data stream creation, RunOnce registry modifications, scheduled tasks with unusual names, and outbound traffic from non-browser processes to known resolver domains. Blocking identified command-and-control infrastructure and applying strict scanning controls to email attachments can also reduce the likelihood of initial compromise.
If this activity is detected, isolate the affected host immediately, collect volatile evidence, and perform full forensic acquisition. Remove files hidden in alternate data streams, delete the malicious RunOnce registry entry, and disable any related scheduled tasks. Known resolver domains and IP addresses should be blocked at the network edge, and endpoint detections should be updated to identify the observed command lines and fileless execution patterns.
Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (T1564.007) designed to trigger the detection rule. The commands and narrative directly produce the telemetry expected by the detection logic.
Attack Narrative & Commands: An operator has obtained the GammaWorm payload (a compiled PE) and wishes to achieve persistence while remaining hidden from traditional file listings. The attacker writes the payload into an NTFS Alternate Data Stream named GTR inside the user’s profile directory. Windows will treat the ADS as part of the normal file ( %USERPROFILE%gamma.exe:GTR ). Because the ADS name matches the rule’s hard‑coded list, any file‑creation event that includes “:GTR” under %USERPROFILE% will fire the detection.
Regression Test Script: (self‑contained; can be run on any Windows host with PowerShell 5+)
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
