Executive Summary
A recent campaign attributed to UAC-0226 (associated with Gamaredon) demonstrates an evolution in their delivery tradecraft, specifically targeting Ukrainian reconnaissance and UAV personnel. The threat actor is leveraging a WinRAR path traversal vulnerability involving NTFS Alternate Data Streams (ADS) to silently plant persistence mechanisms and payloads during archive extraction. This method allows the actor to bypass traditional manual execution requirements by placing a shortcut directly into the user's Startup directory.
Technically, the attack progresses through an obfuscated PowerShell loader that resolves native NT APIs to reflectively map a headerless PE image into memory. The final payload is the GIFTEDCROOK stealer, which has been updated to include broader targeting of Chromium and Firefox browser secrets, KeePass databases, VPN configurations, and sensitive document formats. This evolution reflects a shift toward more operationalized packaging, utilizing custom headers and execution telemetry to improve evasion and reliability.
The use of lures specific to Ukrainian military operations suggests a focused espionage motive. The transition to more sophisticated in-memory mapping techniques and the exploitation of recent WinRAR vulnerabilities (CVE-2025-6218 and CVE-2025-8088) highlights an urgent need for organizations to update archiving software and monitor for anomalous Startup folder modifications.