3: Inside Gamaredon Cyber Operations

Sekoia.io TDR documents a January 2026 Gamaredon intrusion chain targeting Ukrainian government and critical infrastructure, detailing initial phishing (GammaPhish) exploiting CVE-2025-8088 to drop an HTA that fetches loaders (GammaLoad), a VBScript-based propagating worm (GammaWorm) using NTFS ADS and LNK-based USB/network propagation, and a modular PowerShell stealer (GammaSteel) that stages modules in the registry and exfiltrates to S3-compatible storage; the report includes IOCs, Dead Drop Resolver and C2 infrastructure, and recommended hunting/detection opportunities.