3: Gamaredon's Gammasteel Infostealer

This Sekoia.io investigation documents Gamaredon's 2026 "GammaSteel" stealer and its global infrastructure: an obfuscated PowerShell/VBScript "matryoshka" that stages 71 DPAPI-encrypted functions in HKCU\Printers, establishes persistence and a mutex, monitors drives/USB and real-time file activity, deduplicates and uploads sensitive documents to S3 (s3.tebi.io) with fallback operator C2s and DDR-hosted configurations, and supports bidirectional execution of VBScript from C2 responses—demonstrating a resilient, automated, nation-state scale espionage campaign targeting Ukrainian entities.