FSB’s matryoshka #3/3 – Gamaredon’s gifts that keeps unpacking – GammaSteel

This Sekoia.io report analyzes Gamaredon's 2026 "GammaSteel" stealer and supporting infrastructure: a PowerShell stealer staged encrypted in HKCU\Printers using DPAPI, driven by an orchestrator that implements hourly drive scans, USB replication, and real-time FileSystemWatcher monitors to harvest documents; exfiltration favors legitimate S3-compatible storage with fallback operator C2 supporting bidirectional VBScript execution, and actor resilience is maintained via Dead Drop Resolvers, DDNS, and rapidly rotated operator servers—indicating a sophisticated, persistent espionage campaign targeting Ukrainian entities.