FSB Group Gamaredon Hides Worm in Windows Data Streams

Sekoia reports that Russian state-linked APT Gamaredon used a WinRAR path-traversal flaw (CVE-2025-8088) to install a hidden HTA and deploy a worm called GammaWorm; the worm hides modules in NTFS Alternate Data Streams, runs fileless VBScript, propagates via USB and network shares, and uses public services (Telegram, Cloudflare) as dead-drop resolvers for C2. Organizations are advised to update WinRAR to 7.13+ and to consider full system wipes for infected hosts due to the malware's stealth and ability to reinfect via remote payloads.