Sekoia's investigation links ErrTraffic, a ClickFix malware-as-a-service framework, to two clusters using Polygon smart contracts to resolve C2. Forensic analysis details WordPress compromises, backdoors, malware campaigns, AI-themed lures and detection options.
Sekoia’s TDR team reviews APT28’s tradecraft across two decades, highlighting disposable implants, compromised edge routers, cloud-based command-and-control and LameHug, whose attribution to APT28 is assessed with medium confidence.
Sekoia researchers analyze Gamaredon’s GammaSteel stealer, describing DPAPI-encrypted PowerShell functions stored in the Windows registry, document collection from drives and USB devices, and exfiltration through cloud storage with C2 and Dead Drop Resolver fallbacks.
Sekoia analyzes Gamaredon’s three-stage GammaLoad chain, which caches C2 URLs in the Windows registry, falls back to dead drop resolvers on legitimate services, uses a scheduled task, and loads the GammaSteel stealer in memory.
Sekoia reconstructed a January 2026 Gamaredon chain using a CVE-2025-8088 WinRAR archive to deploy GammaPhish and GammaWorm, which persists in NTFS alternate data streams, spreads via USB and network drives, and operates as a backdoor.
