Gamaredon Uses GammaSteel Stealer to Exfiltrate Files and Maintain Access
Summary
Sekoia researchers detail Gamaredon’s GammaSteel stealer, which stages encrypted PowerShell functions in the Windows registry, collects files from drives and USB devices, and exfiltrates them through cloud storage and fallback infrastructure.
Key points
- GammaSteel stages 71 PowerShell functions in the HKCU\Printers registry key, encrypting them with Windows DPAPI tied to the current user.
- The stealer persists through a Windows Run key entry and launches hidden PowerShell processes.
- It scans drives hourly, monitors USB devices, and watches files for changes to collect documents and other targeted file types.
- Stolen files are deduplicated using MD5 hashes and uploaded to S3-compatible storage, including Tebi.io.
- Fallback C2 servers can receive stolen files and return VBScript for execution; dead drop resolvers provide updated infrastructure and credentials.
- The campaign uses obfuscation, Windows features, and legitimate online services to evade analysis and sustain access.
- Sekoia reports that Gamaredon continues targeting Ukrainian government and critical infrastructure, and says DPAPI-protected registry staging is a newly observed technique for the group.
Article Details
- Attack Vectors
- GammaSteel stages 71 encrypted PowerShell functions in the HKCU\Printers registry key and launches the orchestrator in hidden PowerShell processes.
- The malware establishes persistence through the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run key.
- It searches local drives, network shares, and USB media for files, and monitors fixed drives for changes to selected file types.
- It exfiltrates files to S3-compatible storage and falls back to operator-controlled HTTP endpoints; the fallback channel can return VBScript for execution on the compromised host.
- When configured endpoints fail, the malware retrieves replacement infrastructure and storage configuration from dead drop resolver pages.
- Defensive Notes
- Monitor the HKCU\Printers registry key for staged PowerShell code and the current user's Run key for hidden PowerShell commands that retrieve and execute registry content.
- Investigate hidden PowerShell processes, encoded PowerShell arguments, and use of ConvertTo-SecureString or ConvertFrom-SecureString without a key.
- Monitor for recursive collection of document files from local drives, network shares, and newly connected USB drives, including staging directories hidden with attrib +h.
- Inspect outbound HTTP PUT and POST activity to S3-compatible storage and unusual HTTP requests to dead drop resolver pages; GammaSteel may use these channels to exfiltrate files or retrieve configuration and code.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | justsstop[.]ru | Operator-controlled fallback C2 and document-exfiltration domain. |
| DOMAIN | myvnc[.]com | DDNS domain observed during the campaign's initial-access phase. |
| DOMAIN | norosta[.]ru | Actor-controlled domain used to resolve C2 or staging infrastructure. |
| DOMAIN | serveftp[.]com | DDNS domain observed during the campaign's initial-access phase. |
| DOMAIN | serveirc[.]com | DDNS domain observed during the campaign's initial-access phase. |
| DOMAIN | webhop[.]me | DDNS domain observed during the campaign's initial-access phase. |
| IPV4 | 165[.]22[.]170[.]129 | Hardcoded fallback C2 and document-exfiltration server. |
| URL | hxxps[:]//api[.]telegra[.]ph/getPage/Hello-01-23-161 | Dead drop resolver URL queried by the stealer for configuration data. |
| URL | hxxps[:]//mastodon[.]social/api/v1/statuses/115942411657067215 | Dead drop resolver URL queried by the stealer for configuration data. |
| URL | hxxps[:]//rentry[.]co/hwzrmfkx | Dead drop resolver URL used to retrieve network indicators and S3 credentials. |
| URL | hxxps[:]//write[.]as/api/posts/1nei1af6dnw8q | Dead drop resolver URL queried by the stealer for configuration data. |
MITRE ATT&CK
T1005 · Data from Local SystemThe stealer searches local user profiles and local drives for documents to collect.T1025 · Data from Removable MediaOn detecting USB mass-storage devices, the malware copies selected files from them to a hidden staging directory.T1027 · Obfuscated Files or InformationThe scripts use Base64, XOR, randomized variables, and junk code to obfuscate payloads.T1039 · Data from Network Shared DriveThe stealer scans network shares for files and sends selected paths to its exfiltration function.T1041 · Exfiltration Over C2 ChannelWhen primary cloud storage is unavailable, GammaSteel sends collected files to fallback C2 endpoints over HTTP.T1059.001 · PowerShellGammaSteel uses PowerShell to stage and execute its functions, including the registry-resident orchestrator.T1059.005 · Visual BasicThe article describes VBScript payloads and execution of VBScript returned in fallback C2 responses.T1071.001 · Web ProtocolsThe malware uses HTTP requests for configuration retrieval, file exfiltration, and fallback C2 communication.T1074.001 · Local Data StagingFiles copied from USB drives are staged in a hidden directory under the user profile or ProgramData before exfiltration.T1102.001 · Dead Drop ResolverThe stealer queries dead drop resolver pages hosted on public web services to obtain updated configuration and infrastructure.T1112 · Modify RegistryGammaSteel writes encrypted functions and configuration into registry keys, including HKCU\Printers.T1119 · Automated CollectionGammaSteel automates collection through recurring drive scans, USB event monitoring, and file-change watchers.T1140 · Deobfuscate/Decode Files or InformationThe malware decodes Base64 strings and applies XOR operations to unpack code in memory.T1547.001 · Registry Run Keys / Startup FolderThe malware writes a PowerShell command to the current user's Run key to relaunch the orchestrator at startup.T1564.001 · Hidden Files and DirectoriesThe malware marks its USB-file staging directory as hidden using attrib +h.T1567.002 · Exfiltration to Cloud StorageThe primary exfiltration method uploads collected files to S3-compatible cloud storage.
People
Threat Actors
ArmagedonThe article explicitly identifies Armagedon as an alternate name for Gamaredon.GamaredonThe article attributes the campaign and GammaSteel operations to this group.InvisiMoleThe article describes this FSB-linked intrusion set's historical behaviors as overlapping with GammaSteel's DPAPI use, while noting potential—not confirmed—sharing of tools or methods.UAC-0010The article explicitly identifies UAC-0010 as an alternate name for Gamaredon.
Malware
GammaLoadFSB’s matryoshka #2/3 - GammaLoadGammaPhishFSB’s matryoshka #1/3 - GammaPhish and GammaWormGammaSteelFSB’s matryoshka #3/3 - Gamaredon’s gifts that keeps unpacking - GammaSteelGammaWipeGammaWipe (wiper)GammaWormFSB’s matryoshka #1/3 - GammaPhish and GammaWormPteranodonconventions. Over the past decade, their espionage arsenal has heavily evolved, shifting from the Pteranodon framework to highly modular, standalone payloads tracked under various names. To cut through this
Vendors
Cloudflarebe invisible: by hiding inside legitimate Windows features and abusing trusted platforms like Telegram, Cloudflare, and standard cloud storage, Gamaredon leaves almost no trace on infected machines. Once inside aNo-IPA part of the infrastructure relies on Dynamic DNS (DDNS) services provided by No-IP. Domains such as serveirc[.]com, webhop[.]me, serveftp[.]com, and myvnc[.]com are primarily observed during the initial access phase,SupabaseFurthermore, Gamaredon leverages Supabase to host its payloads, exploiting the platform's positive reputation to evade basic security filters. As a legitimate Backend-as-a-Service provider, Supabase offers anTebi.ioMD5 hashes. The data is then systematically uploaded to legitimate S3-compatible cloud storage (Tebi.io).
Products
Microsoft WindowsThe infection chain is designed to be invisible: by hiding inside legitimate Windows features and abusing trusted platforms like Telegram, Cloudflare, and standard cloud storage, Gamaredon leaves almost no trace onPowerShellrequests from GammaLoad analysed in the second report of this series. The payload is an obfuscated PowerShell script that acts as a dropper for the stealer. The code employs Base64 encoding combined with a XOR
Countries
Russiaspecialized in long-term and persistent intrusion operations targeting Ukraine. Officially operated by Russia's FSB, the group is focusing government, military, and critical infrastructure networks, and is stillUkraineis a cyberespionage group specialized in long-term and persistent intrusion operations targeting Ukraine. Officially operated by Russia's FSB, the group is focusing government, military, and critical
Industries
Critical infrastructureUkraine. Officially operated by Russia's FSB, the group is focusing government, military, and critical infrastructure networks, and is still actively operating at the time of this publication.Governmentintrusion operations targeting Ukraine. Officially operated by Russia's FSB, the group is focusing government, military, and critical infrastructure networks, and is still actively operating at the time of thisMilitaryoperations targeting Ukraine. Officially operated by Russia's FSB, the group is focusing government, military, and critical infrastructure networks, and is still actively operating at the time of this publication.