Gamaredon Deploys GammaDrop, GammaLoad in Phishing Campaigns

Gamaredon (also tracked as UAC-0010/Shuckworm) is running sustained multi-stage phishing campaigns against Ukrainian government organizations by exploiting WinRAR CVE-2025-8088 to drop obfuscated VBScript loaders (GammaDrop and GammaLoad) via RAR/ARJ archives and NTFS ADS; GammaLoad persists via RunOnce, collects system identifiers, beacons periodically to Cloudflare Workers-hosted C2 (with fallbacks on Russian domains), and operators rotate infrastructure and abuse weak email authentication—recommended mitigations include patching WinRAR, enforcing SPF/DKIM/DMARC, and blocking known malicious IP ranges.