Sekoia Details Gamaredon’s GammaPhish and GammaWorm Infection Chain

Jun 1, 2026 · Original article ↗

Summary

Sekoia reconstructed a January 2026 Gamaredon chain using a CVE-2025-8088 WinRAR archive to deploy GammaPhish and GammaWorm, which persists in NTFS alternate data streams, spreads via USB and network drives, and operates as a backdoor.

Key points

Sekoia’s investigation combined YARA-based hunting, more than 70 artifacts recovered from compromised hosts, and live payload acquisition to reconstruct part of a January 2026 Gamaredon infection chain.
A weaponized xHTML file uses HTML smuggling to deliver a RAR archive exploiting CVE-2025-8088; opening the archive extracts an HTA file into the Windows Startup folder. The researchers could not retrieve the remote payload.
GammaWorm is a heavily obfuscated VBScript worm that hides modules in NTFS Alternate Data Streams and uses registry entries and scheduled tasks for persistence.
The worm propagates through USB and network drives, hiding legitimate directories and replacing them with LNK shortcuts that can open the folder while executing the worm.
GammaWorm uses Dead Drop Resolvers to update its command-and-control configuration and can receive and execute remote VBScript; the article describes its host fingerprint being sent in HTTP headers.
The investigation found GammaLoad directly deploys GammaSteel, but the route by which GammaWorm is introduced remains unclear. Sekoia reported no traces of the historical Pteranodon framework in this chain.

Article Details

Attack Vectors: The authors assess, based on ESET reporting, that the xHTML lure was likely delivered in a spearphishing email or an attached archive; they did not identify the preceding delivery vector.
The xHTML file uses HTML smuggling to deliver a Base64-embedded RAR archive. The archive exploits CVE-2025-8088 to extract an HTA file into the Windows Startup directory; the user must manually open the archive.
The extracted HTA uses mshta.exe to request a remote payload from Gamaredon infrastructure. The authors could not retrieve that payload and assess that it would likely deploy GammaLoad.
GammaWorm hides VBScript modules in NTFS Alternate Data Streams, establishes persistence through registry entries and scheduled tasks, and can execute remotely supplied VBScript.
GammaWorm propagates through USB and network drives by hiding legitimate directories and replacing them with LNK decoys that open the folder while executing the worm.
GammaWorm uses Dead Drop Resolvers hosted on web services to obtain C2 configuration, then sends host fingerprints in HTTP headers and can execute code returned by C2.
GammaSteel scans local and network drives, monitors USB insertion and file changes, and exfiltrates targeted files to an S3-compatible storage provider, with operator-controlled C2 servers as fallback.
Defensive Notes: The article recommends a complete wipe as the safest remediation for affected hosts because Dead Drop Resolvers can deliver fresh payloads and restore malware after cleaning attempts.
Hunt for GammaWorm Alternate Data Streams named GTR, save, URL, LNK, and SERVER, and for wscript.exe command lines targeting paths containing a colon that is not followed by a backslash.
Monitor the RunOnce\ExplorerGuard registry entry and the scheduled tasks DiskDiagnosticDataCollector, SilentCleanup, and SmartRetry described in the report.
Inspect HKCU\Console registry values used to store active C2 configuration, including WindowsUpdates, WindowsResponby, WindowsDetect, URLTeletype, WindowsTelegra, URLTelegra, and IpURL.
Look for recurring outbound requests to the reported Dead Drop Resolver services from non-browser processes such as wscript.exe or hidden PowerShell instances.

Indicators of compromise

Type	Indicator	Context
IPV4	`104[.]194[.]140[.]6`	IP address identified in the article as GammaWorm C2 infrastructure.
MD5	`1794369214b7f62e70a0485e61335c61`	MD5 hash of the weaponized xHTML file analyzed as the GammaPhish infection-chain sample.
MD5	`8e1624d110c090ff57d4b493a9107c66`	MD5 hash of the GammaWorm file named ~.gif analyzed in the report.
URL	`hxxp[:]//iiwdsxwamylbwwsoyrmj[.]supabase[.]co/functions/v1/clever-responder/KokonGoogle_09.12.2025`	GammaPhish tracking-pixel URL used to report that the lure document was opened.
URL	`hxxps[:]//bold[.]zsjtn41091[.]workers[.]dev`	Specific Cloudflare Workers URL recorded as a GammaWorm Dead Drop Resolver and network-configuration stage.
URL	`hxxps[:]//efficiency-planes-emotions-fascinating[.]trycloudflare[.]com/@myrain/Xh1Lta2Ccro?84wtj9ob-01-31`	C2 configuration URL returned in a reproduced GammaWorm request response and parsed into active network settings.
URL	`hxxps[:]//graph[.]org/kyjfkyr-12-06`	Hardcoded Dead Drop Resolver page queried by GammaWorm to obtain subsequent network configuration.
URL	`hxxps[:]//moment-cat-qld-place[.]trycloudflare[.]com/sylvilagus`	Specific Cloudflare tunnel URL recorded as part of the GammaWorm C2 configuration chain.
URL	`hxxps[:]//quitethepastry[.]ru`	Domain explicitly identified by the article as operator-controlled GammaWorm infrastructure.
URL	`hxxps[:]//telegra[.]ph/f8bfl6sp-01-02`	Specific Telegraph page used in the reported GammaWorm Dead Drop Resolver chain.
URL	`hxxps[:]//teletype[.]in/@myrain/Xh1Lta2Ccro`	Specific Teletype page used in GammaWorm's Dead Drop Resolver chain to provide network configuration.
URL	`hxxps[:]//www[.]bbc[.]com@iiwdsxwamylbwwsoyrmj[.]supabase[.]co/functions/v1/clever-responder/GurGoogle_09.12.2025/audience/capture.pdf`	Remote payload URL invoked by the malicious HTA through mshta.exe; the article says the C2 did not deliver the payload during testing.
URL	`hxxps[:]//www[.]telegram[.]me/s/oberfarir`	Public Telegram channel queried by GammaWorm to extract an obfuscated C2 IP address.