Gamaredon's Matryoshka: Multi-Stage Espionage Against Ukraine

Gamaredon (aka UAC-0010, Armagedon) continues its persistent cyberespionage campaign targeting Ukrainian governmental and critical infrastructure entities. Officially linked to the Russian Federal Security Service (FSB), the group has evolved its tradecraft toward a highly modular, "matryoshka" (doll-within-a-doll) architecture. This approach utilizes a chain of loaders and droppers that reside primarily in memory or within the Windows Registry, significantly increasing the complexity of forensic analysis.

The 2026 infection chain relies on a combination of spearphishing, exploit-driven initial access (CVE-2025-8088), and multi-stage VBScript/PowerShell components. Key elements include GammaWorm for propagation across USB and network drives, and GammaSteel, a sophisticated stealer that uses Windows DPAPI for registry-based staging. The group aggressively leverages legitimate cloud services like Cloudflare, Telegram, and S3-compatible storage (Tebi.io) to mask their command-and-control (C2) traffic and exfiltration activities.

This campaign represents a technical escalation, shifting from fixed frameworks to a distributed, automated ecosystem where every stage functions as a potential backdoor. The resilience of their infrastructure, which features high-frequency host rotation and automated updates to Dead Drop Resolvers (DDR), underscores the threat to regional security and the ongoing risk to sensitive government data.