Gamaredon Spearphishing CVE-2025-8088 Office Child Process Execution

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•7

Detects suspicious child processes (such as PowerShell, CMD, or WScript) being spawned by Microsoft Office applications or email clients, which is indicative of exploitation activity consistent with Gamaredon spear-phishing campaigns. This specifically monitors for execution patterns attempting to deploy 'Ptero' family implants potentially following exploitation of vulnerabilities such as CVE-2025-8088.