GammaSteel: Inside Gamaredon's Unfolding Malware Chain

The report describes GammaSteel, a new Gamaredon ( UAC-0010 ) intrusion chain built around a fileless PowerShell stealer. The malware stores 71 encrypted functions in the HKCU\Printers registry key and protects them with Windows DPAPI. It collects documents from local drives, USB media, and files being actively edited, then deduplicates the data with MD5 before exfiltrating it to the legitimate S3-compatible service Tebi.io , with fallback to hard-coded Russian domains. The wider infrastructure also relies on dead-drop resolvers hosted on public platforms such as Telegram, Telegra.ph, Write.as, Rentry.co, and Mastodon, along with dynamic DNS services. The campaign continues to target Ukrainian government and critical infrastructure environments.

Sekoia.io analyzed more than 70 artifacts, rebuilt the full PowerShell dropper, and identified registry-based persistence, a mutex, hidden scheduled PowerShell execution, and a multi-layered exfiltration scheme. The researchers mapped the dead-drop resolver infrastructure, catalogued 115 IP addresses, four domains, and several S3 credential sets, and observed automated updates made through Mastodon posts. They also noted similarities with the 2020 InvisiMole activity, particularly the use of DPAPI-encrypted payloads stored in the registry.

Organizations should monitor for unusual writes to HKCU\Printers , creation of hidden PowerShell processes, and usage of the Global\assembly307 mutex. Outbound traffic to the identified S3 endpoint s3.tebi.io and fallback infrastructure such as justsstop.ru and 165.22.170.129 should be blocked. Defenders should also deploy detections for the specific iPhone-style user-agent string and for Registry Run entries that invoke PowerShell scripts.

If GammaSteel activity is detected, isolate the affected host, collect the HKCU\Printers registry hive, extract the DPAPI-protected payloads, and decrypt them using the victim’s master key where possible. Hunt across the environment for related artifacts, block the identified command-and-control URLs and domains, reset any compromised credentials, and perform a full forensic review to identify additional malicious modules.

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

Attack Narrative & Commands: The attacker, having compromised a low‑privileged user account, wants to stage an encrypted PowerShell payload without touching the file system. They write the Base64‑encoded payload into the Run key so it executes on the logon. To avoid the rule’s single exclusion, they deliberately use a sub‑key under HKCUPrinters that is not the excluded value, mimicking the “printer‑staging” pattern observed in Gamaredon samples.

Regression Test Script:

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.