Gamaredon Uses CVE-2025-8088 to Deploy GammaDrop and GammaLoad in Ukraine Campaign
Summary
The report details Gamaredon’s campaign against Ukrainian state institutions, showing how CVE-2025-8088 weaponized archives install GammaDrop and GammaLoad, which establish persistence, profile hosts and retrieve tailored payloads.
Key points
- Researchers identified a campaign targeting Ukrainian state institutions, active since at least September 2025; they attribute it to Gamaredon with high confidence based on targeting, tooling and infrastructure.
- Spearphishing emails from compromised or spoofed government accounts delivered archives exploiting CVE-2025-8088 in WinRAR to write a VBScript payload into the Windows Startup folder.
- GammaDrop downloads and executes GammaLoad; GammaLoad establishes persistence, profiles the host and beacons to command-and-control servers for a next-stage payload.
- The operators used rotating delivery infrastructure, including Cloudflare Workers, fast-flux DNS, dynamic DNS and fallback domains.
- Weak or absent SPF and DMARC protections allowed some spoofed emails to be delivered; the report recommends strict DMARC enforcement.
Article Details
- Attack Vectors
- Spearphishing emails, including messages sent from compromised government accounts or spoofed government identities, delivered weaponized RAR and ARJ archives to Ukrainian institutions.
- RAR archives exploited CVE-2025-8088 in WinRAR: an NTFS alternate data stream with a path-traversal sequence caused a VBScript payload to be written to the Windows Startup folder.
- GammaDrop used obfuscated VBScript to retrieve a remote HTA payload from Cloudflare Workers infrastructure, save it in a temporary directory, and execute it.
- GammaLoad used a RunOnce registry key for persistence, profiled infected hosts, beaconed to C2 infrastructure, and could execute a subsequently delivered payload.
- Defensive Notes
- Enforce strict DMARC policies for government domains; the article reports that stricter enforcement could have blocked a significant portion of the spoofed emails.
- Consider network-level blocking of the 194.58.66.0/24 subnet, which the article identifies as a persistent operational hub used for SMTP clients and email relays.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | kosoyed[.]ru | Fallback GammaLoad C2 domain used for beaconing and payload delivery. |
| DOMAIN | rubakovox[.]pro | Standalone C2 domain used in later GammaDrop waves. |
| DOMAIN | uarefire[.]ru | GammaLoad fallback C2 domain identified in the article's infrastructure list. |
| HOSTNAME | a[.]cnbyvilkghx2a6p[.]workers[.]dev | Primary GammaLoad C2 host used for beaconing and next-stage payload delivery. |
| HOSTNAME | favoriteclown[.]endl[.]site | GammaLoad primary C2 host identified in the article's infrastructure list. |
| HOSTNAME | heart7766[.]vmkyieebw2[.]workers[.]dev | GammaLoad C2 host used by a later variant. |
| HOSTNAME | relay[.]astrocaf[.]com | Email relay used to send spoofed spearphishing messages. |
| HOSTNAME | thre6d[.]rfgah07ggr[.]workers[.]dev | GammaDrop delivery host used in a later campaign wave. |
| HOSTNAME | throbsuns2[.]h4puonhajw[.]workers[.]dev | GammaDrop delivery host used to fetch the GammaLoad HTA payload. |
| IPV4 | 107[.]189[.]19[.]48 | IP identified as a GammaLoad primary C2 address. |
| IPV4 | 194[.]58[.]66[.]106 | Client IP used to relay spoofed emails through relay.hvosting[.]ua. |
| IPV4 | 194[.]58[.]66[.]139 | Client IP used to relay spoofed emails through tzk701.nic[.]ua and h64.hvosting[.]ua. |
| IPV4 | 194[.]58[.]66[.]53 | Persistent operator IP observed connecting to email relay infrastructure and sending spoofed messages. |
| IPV4 | 194[.]58[.]66[.]82 | IP address of the relay server associated with spoofed spearphishing emails. |
| IPV4 | 5[.]181[.]2[.]158 | IP identified as a GammaLoad primary C2 address. |
| IPV4 | 77[.]110[.]107[.]165 | IP identified as a GammaLoad primary C2 address. |
| SHA256 | 1e57e3c3225afcd4eece2f2dec9ac7f4a181a2681c3b8a56b831046aa8277007 | SHA-256 of a weaponized RAR archive exploiting CVE-2025-8088. |
| SHA256 | 2bef643f22532f907ea64f31663564e42697577d4a06f57399ecfce9aaf939a7 | SHA-256 of a GammaLoad sample listed in the article's IOC appendix. |
| SHA256 | 40357c6a326f5e669b304295941308b83af1b7bdedb3c636a7128d28befcf85e | SHA-256 of a GammaDrop HTA sample listed in the article's IOC appendix. |
| SHA256 | 62818ae5e305b89b9461536dac1b9daf4cebd99d24e417357e27e2ae4582a704 | SHA-256 of the GammaDrop VBScript payload. |
| SHA256 | 69cdde1ec82099a471283de89dd5e17266b1d8dda57d3c1589b7754b009fa2ed | SHA-256 of the GammaLoad HTA implant. |
| SHA256 | 86d9357bda4769036362832c039dbe800121ed9a966e8b59a3f9cccab61cdafb | SHA-256 of a GammaLoad HTA sample listed in the article's IOC appendix. |
| SHA256 | 92aaeb49888fa8c392ac088b2a104675c9fd0eaa081ccf1024d0452b67b782a2 | SHA-256 of a later GammaLoad variant. |
| SHA256 | 9fc2a247313b078d795419b7d1c7c0cd907a103a4c64ebab6c96ddb7b958d230 | SHA-256 of a GammaLoad sample listed in the article's IOC appendix. |
| SHA256 | ac985354b7efd4356954c316c797e56ed88aa4651798bd79b5c7ebb353546a30 | SHA-256 of a malicious ARJ archive listed in the article's IOC appendix. |
| SHA256 | afa005ad2707e4b6e1e565091c57ec5abdf45cd738bd1f1edfc04fcca1ad9c64 | SHA-256 of a malicious ARJ archive listed in the article's IOC appendix. |
| SHA256 | bd7237f92cc020ed71ae08a2eff01159900242164030c5c006191c4ca5322961 | SHA-256 of a GammaDrop VBScript sample listed in the article's IOC appendix. |
| SHA256 | be05c74c5ed62be987bbd868c51ab8828d2d5cb37b128d7e3d38f676591a233f | SHA-256 of a GammaDrop sample from a later campaign wave. |
| SHA256 | c0b7a42bd52d3b21de66ce8437d9a068eacc3feb065202d32377690c9a80d580 | SHA-256 of a GammaLoad HTA sample listed in the article's IOC appendix. |
| SHA256 | d6476b2cee21f01e3c545d0355a0730efd9ac4a2821a08eac68da05b0bb3e716 | SHA-256 associated with the earliest spearphishing email sample identified in the report. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationGammaDrop and GammaLoad used obfuscated VBScript with randomized variables, junk functions, and string-building techniques.T1036 · MasqueradingThe archive included a PDF decoy, while payload files used document-like or image-like extensions to conceal their function.T1041 · Exfiltration Over C2 ChannelGammaLoad sent victim-identifying host information and beacon timing to C2 servers in its User-Agent.T1059.005 · Visual BasicThe infection chain executed obfuscated VBScript payloads through wscript.T1071.001 · Web ProtocolsGammaLoad used HTTP GET requests through MSXML2.XMLHTTP to communicate with its C2 servers.T1082 · System Information DiscoveryGammaLoad collected the computer name, system drive, and volume serial number to profile the infected host.T1105 · Ingress Tool TransferGammaDrop downloaded GammaLoad, and GammaLoad beaconed for and executed a subsequent payload.T1112 · Modify RegistryGammaLoad established persistence by creating a RunOnce registry key.T1124 · System Time DiscoveryGammaDrop used the current date to construct payload URLs, and GammaLoad included a beacon timestamp in its request data.T1204.002 · Malicious FileThe archive-based infection chain began when a recipient extracted or opened the attachment.T1218.005 · MshtaGammaDrop launched the GammaLoad HTA using mshta.exe in a hidden window.T1547.001 · Registry Run Keys / Startup FolderCVE-2025-8088 exploitation wrote the GammaDrop VBScript into the Windows Startup folder for persistence.T1566.001 · Spearphishing AttachmentGamaredon delivered weaponized RAR and ARJ archives as email attachments in spearphishing messages.T1583.001 · DomainsThe campaign used registered fallback C2 domains, including kosoyed[.]ru.T1583.006 · Web ServicesThe operators used Cloudflare Workers and quick tunnels as disposable-looking payload-delivery and C2 infrastructure.
CVE
Threat Actors
Aqua BlizzardThe article identifies Aqua Blizzard as an alternate name for Gamaredon, which it attributes with high confidence to the reported campaign.GamaredonHarfangLab attributes the spearphishing and malware activity to Gamaredon with high confidence, citing the targeting, tooling, delivery, and infrastructure.Primitive BearThe article identifies Primitive Bear as an alternate name for Gamaredon, which it attributes with high confidence to the reported campaign.ShuckwormThe article identifies Shuckworm as an alternate name for Gamaredon, which it attributes with high confidence to the reported campaign.UAC-0010The article identifies UAC-0010 as an alternate name for Gamaredon and attributes the reported campaign to Gamaredon with high confidence.
Malware
GammaDropThe operation relies on GammaDrop and GammaLoad, with Cloudflare Workers, fast flux, DDNS, and compromised email infrastructure supporting selective payload delivery and host profiling.GammaLoadThe operation relies on GammaDrop and GammaLoad, with Cloudflare Workers, fast flux, DDNS, and compromised email infrastructure supporting selective payload delivery and host profiling.
Vendors
Products
Cloudflare WorkersThe operation relies on GammaDrop and GammaLoad, with Cloudflare Workers, fast flux, DDNS, and compromised email infrastructure supporting selective payload delivery and host profiling.Microsoft WindowsCVE-2025-8088 in WinRAR was exploited to write a VBScript payload into the Windows Startup folder, enabling persistence.WinRARCVE-2025-8088 in WinRAR was exploited to write a VBScript payload into the Windows Startup folder, enabling persistence.
Tools
Countries
Industries
GovernmentThe actor used spearphishing emails sent from compromised or spoofed government accounts to deliver weaponized RAR and later ARJ archives.Law enforcementThe primary targets were Ukrainian state institutions, especially the SSU, along with courts, prosecutors, military, law enforcement, and regional administrative bodies.MilitaryThe primary targets were Ukrainian state institutions, especially the SSU, along with courts, prosecutors, military, law enforcement, and regional administrative bodies.