Gamaredon: GammaPhish → GammaWorm (NTFS ADS + USB) → GammaSteel (S3 exfil) — the week's most complete intrusion kill-chain disclosure
Monday 2 June brought Sekoia's part-one Gamaredon series (Sekoia TDR, 2026-06-01), consolidating three capability clusters under unified naming: GammaPhish (the spearphishing-through-GammaLoad funnel), GammaWorm (the USB-and-network-propagation layer), and GammaSteel (the S3-exfiltration stealer confirmed in the same campaign arc via Sekoia TDR follow-up, daily 2026-06-03).
Initial access (GammaPhish): weaponised xHTML files exploiting CVE-2025-8088 (the WinRAR path-traversal flaw, patched but widely unpatched) drop HTA payloads into Windows Startup directories via mshta.exe. Propagation (GammaWorm): a 20,000+-line obfuscated VBScript worm persists via scheduled tasks and Run/RunOnce registry keys, hides components in NTFS Alternate Data Streams, and spreads across USB drives and mapped network shares using Ukrainian-language lures (T1025, T1091). C2 resolves through dead-drop pages on Telegram, Telegra.ph, Teletype.in, Supabase and Cloudflare Workers — all platforms with high allow-list rates at enterprise egress proxies. Exfiltration (GammaSteel): the S3-exfiltration stealer stages and uploads collected data directly to attacker-controlled AWS S3 buckets.
The detection pattern across all three stages is highly transferable to non-Ukraine targets. Hunt for: mshta.exe spawning wscript.exe; large obfuscated VBScripts executing from %APPDATA%; scheduled tasks with randomised GUID names pointing into user-profile paths; NTFS ADS on %TEMP%/%APPDATA% files (dir /r or Sysmon EID 11 for streams); outbound HTTPS to Telegra.ph / Supabase / Workers from non-developer hosts; and anomalous S3-API calls from user endpoints.
ATT&CK mapping
2 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Initial Access TA0001
T1091Replication Through Removable Media
Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Lateral Movement TA0008
T1091Replication Through Removable Media
Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Collection TA0009
T1025Data from Removable Media
Adversaries may search connected removable media on computers they have compromised to find files of interest. Sensitive data can be collected from any removable media (optical disk drive, USB memory, etc.) connected to the compromised system prior to Exfiltration. Interactive command shells may be in use, and common functionality within cmd may be used to gather information.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.