Executive Summary
Since September 2025, the threat actor Gamaredon (UAC-0010) has conducted at least 12 waves of spearphishing campaigns targeting Ukrainian government, military, and judicial entities. The group is actively exploiting CVE-2025-8088, a path traversal vulnerability in WinRAR, to silently drop malicious VBScript payloads into the Windows Startup folder for persistence. These campaigns leverage compromised government email accounts or spoofed addresses to deliver weaponized RAR and ARJ archives.
The attack chain involves a first-stage VBScript downloader named GammaDrop, which fetches a second-stage HTA-based implant called GammaLoad. GammaLoad profiles the infected host—collecting computer names and volume serial numbers—and establishes a persistent beacon to C2 infrastructure hosted on Cloudflare Workers and Russian domains. The high operational tempo and automated rotation of infrastructure indicate a persistent and large-scale effort to maintain access to Ukrainian networks.
This activity represents a significant threat to regional security infrastructure. While the malware itself is not technically advanced, Gamaredon's ability to bypass email authentication through compromised internal accounts and their use of redundant path traversal techniques makes them highly effective at scale. Organizations are urged to enforce strict DMARC policies and monitor for unusual VBScript execution from the Startup and Temp directories.