Gamaredon Uses Spoofed Emails, GammaDrop, and GammaLoad

SOC Prime Team

Gamaredon Uses Spoofed Emails, GammaDrop, and GammaLoad

Detection stack

AIDR
Alert
ETL
Query

Threat Report
Attack Flow
Detections
Simulations

Summary

The report outlines a Gamaredon campaign that abuses CVE-2025-8088 to deliver VBScript payloads through weaponized RAR archives attached to spearphishing emails aimed at Ukrainian state organizations. Once opened, the malicious archive drops a GammaDrop downloader, which retrieves a GammaLoad HTA beacon responsible for persistence and communication with Cloudflare-proxied command-and-control infrastructure. The activity has been ongoing since September 2025 and continues to evolve through changes in delivery techniques and infrastructure.

Investigation

Researchers analyzed email headers, archive contents, and the embedded VBScript and HTA payloads, uncovering exploitation of a WinRAR path traversal flaw, use of NTFS alternate data streams, and dynamic generation of command-and-control URLs. Their investigation also identified multiple Cloudflare Workers domains, fast-flux DNS patterns, and DDNS services tied to the attacker’s infrastructure.

Mitigation

Organizations should enforce strict DMARC policies, block the 194.58.66.0/24 subnet, and monitor for suspicious RAR5 archives that create alternate data streams in the Startup folder. Defenders should also detect the specific user-agent patterns used by the GammaLoad beacon. Restricting or disabling execution of mshta.exe and limiting access to Wscript.Shell can further reduce the risk of payload execution.

Response

If this activity is detected, isolate the affected endpoint, preserve the malicious RAR archive and VBScript files, remove infected files from the Startup folder, delete the related RunOnce registry entry, and block the identified command-and-control domains and IP addresses. Security teams should then perform forensic analysis to determine the scope of compromise and rotate credentials for any impacted email accounts.

"graph TB %% Class Definitions classDef action fill:#99ccff classDef tool fill:#cccccc classDef file fill:#ffcc99 classDef persistence fill:#ccffcc classDef process fill:#ff99cc %% Nodes – Actions (Techniques) action_email_spoofing["Action – T1672 Email Spoofing Description: Stolen government email credentials are used to authenticate to legitimate mail relays and send spoofed spearphishing messages appearing to originate from Ukrainian government entities."] class action_email_spoofing action action_spearphishing_attachment["Action – T1566.001 Spearphishing Attachment Description: The spoofed emails contain a RAR archive that exploits CVEu20112025u20118088 (WinRAR directoryu2011traversal) to deliver a malicious payload."] class action_spearphishing_attachment action action_taint_shared_content["Action – T1080 Taint Shared Content Description: The archive uses a crafted ADS entry with a pathu2011traversal sequence, causing WinRAR to write the VBScript payload into the Startup folder for persistence."] class action_taint_shared_content action action_masquerading_file_type["Action – T1036.008 Masquerading File Type Description: A decoy PDF file with random ASCII characters is presented to the user while the actual VBScript resides in an alternate data stream."] class action_masquerading_file_type action action_exploit_priv_esc["Action – T1068 Exploitation for Privilege Escalation Description: Exploiting CVEu20112025u20118088 grants code execution and allows writing to privileged locations without user interaction."] class action_exploit_priv_esc action action_obfuscation["Action – T1027 Obfuscated Files or Information Description: GammaDrop and GammaLoad payloads are heavily obfuscated VBScript/HTA using random variable names, junk functions, and stringu2011building techniques."] class action_obfuscation action action_embedded_payloads["Action – T1027.009 Embedded Payloads Description: The secondu2011stage HTA wraps the VBScript beacon and includes a Base64u2011encoded blob."] class action_embedded_payloads action action_deobfuscate["Action – T1140 Deobfuscate/Decode Files or Information Description: The HTA decodes the Base64 blob to write an installer script to the TEMP folder and registers a RunOnce key."] class action_deobfuscate action action_web_c2["Action – T1071.001 Application Layer Protocol Web Protocols Description: The beacon communicates over HTTPS to Cloudflare Workers domains and falls back to a .ru domain, embedding victim identifiers in the Useru2011Agent header."] class action_web_c2 action %% Nodes – Tools tool_winrar["Tool – Name: WinRAR Description: Archive utility exploited via CVEu20112025u20118088 for directoryu2011traversal and ADS write."] class tool_winrar tool %% Nodes – Files file_malicious_rar["File – Name: Malicious RAR archive Content: Contains crafted ADS entry and decoy PDF."] class file_malicious_rar file file_ascad_payload["File – Name: VBScript payload in ADS Location: Written to %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\"] class file_ascad_payload file file_decoy_pdf["File – Name: Decoy PDF Purpose: Masquerades the malicious content to entice the user."] class file_decoy_pdf file file_hta_wrapper["File – Name: HTA wrapper Content: Encodes VBScript beacon as Base64 blob."] class file_hta_wrapper file file_installer["File – Name: Installer script Location: Written to %TEMP% by HTA."] class file_installer file %% Nodes – Persistence persistence_startup["Persistence – Startup Folder Path: %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\"] class persistence_startup persistence persistence_runonce["Persistence – RunOnce Registry Location: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce"] class persistence_runonce persistence %% Nodes – C2 c2_cloudflare["C2 – Cloudflare Workers domain Protocol: HTTPS"] class c2_cloudflare process c2_fallback_ru["C2 – Fallback .ru domain Protocol: HTTPS"] class c2_fallback_ru process %% Connections action_email_spoofing –>|sends| file_malicious_rar file_malicious_rar –>|exploits| tool_winrar tool_winrar –>|triggers| action_spearphishing_attachment action_spearphishing_attachment –>|uses| action_taint_shared_content action_taint_shared_content –>|writes to| file_ascad_payload file_ascad_payload –>|establishes| persistence_startup action_taint_shared_content –>|creates| file_decoy_pdf action_masquerading_file_type –>|presents| file_decoy_pdf action_masquerading_file_type –>|hides| file_ascad_payload action_spearphishing_attachment –>|enables| action_exploit_priv_esc action_exploit_priv_esc –>|facilitates| action_obfuscation action_obfuscation –>|produces| file_hta_wrapper file_hta_wrapper –>|contains| action_embedded_payloads action_embedded_payloads –>|encodes| action_deobfuscate action_deobfuscate –>|writes to| file_installer file_installer –>|registers| persistence_runonce action_deobfuscate –>|initiates| action_web_c2 action_web_c2 –>|communicates with| c2_cloudflare action_web_c2 –>|fallback to| c2_fallback_ru "

Gamaredon Uses Spoofed Emails, GammaDrop, and GammaLoad

Summary

Investigation

Mitigation

Response

Attack Flow

Detections

Possible Persistence Points [ASEPs – Software/NTUSER Hive] (via registry_event)

LOLBAS WScript / CScript (via process_creation)

Suspicious Binary / Scripts in Autostart Location (via file_event)

Possible CVE-2025-8088 / CVE-2025-6218 (WinRAR Vulnerability) Exploitation Attempt (via file_event)

Possible Data Infiltration / Exfiltration / C2 via Third Party Services / Tools (via proxy)

Possible Cloudflare Development Domain Abuse (via dns)

IOCs (HashSha256) to detect: Gamaredon’s Infection Chain: Spoofed Emails, GammaDrop and GammaLoad Part 5

IOCs (HashSha256) to detect: Gamaredon’s Infection Chain: Spoofed Emails, GammaDrop and GammaLoad Part 4

IOCs (HashSha256) to detect: Gamaredon’s Infection Chain: Spoofed Emails, GammaDrop and GammaLoad Part 3

IOCs (HashSha256) to detect: Gamaredon’s Infection Chain: Spoofed Emails, GammaDrop and GammaLoad Part 2

IOCs (HashSha256) to detect: Gamaredon’s Infection Chain: Spoofed Emails, GammaDrop and GammaLoad Part 1

IOCs (HashSha1) to detect: Gamaredon’s Infection Chain: Spoofed Emails, GammaDrop and GammaLoad

IOCs (SourceIP) to detect: Gamaredon’s Infection Chain: Spoofed Emails, GammaDrop and GammaLoad

IOCs (DestinationIP) to detect: Gamaredon’s Infection Chain: Spoofed Emails, GammaDrop and GammaLoad

Detection of GammaDrop and GammaLoad Execution [Windows Process Creation]

Detection of GammaDrop VBScript and GammaLoad HTA Execution [Windows File Event]

Simulation Execution