GammaDrop

Reported Context (2)

#Ghostwriter Ghostwriter Uses Geofenced PDFs to Target Ukrainian Government
The operation relies on GammaDrop and GammaLoad, with Cloudflare Workers, fast flux, DDNS, and compromised email infrastructure supporting selective payload delivery and host profiling. Gamaredon Uses CVE-2025-8088 to Deploy GammaDrop and GammaLoad in Ukraine Campaign

CVE (3)

Malware (7)

People (1)

Threat Actors (19)

MITRE ATT&CK (16)

Vendors (1)

Products (4)

Tools (2)

Industries (9)

Countries (7)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.