Tainted drive appears to be source of malware attack on Western military mission in Ukraine

Symantec researchers reported that Russia‑linked Gamaredon (Shuckworm/BlueAlpha) deployed an updated GammaSteel infostealer in Feb–Mar against a Ukraine‑based Western military mission via an infected removable drive; the campaign used a complex multi‑stage chain, enhanced obfuscation, and legitimate services (with prior use of Cloudflare Tunnels), suggesting growing sophistication in the group's espionage operations.