Russian state-backed hacking group Gamaredon (also known as “Shuckworm”) has conducted a sophisticated cyber espionage campaign against a Western country’s military mission in Ukraine. According to Symantec researchers, the attacks occurred between February and March 2025, utilizing an enhanced version of the GammaSteel information-stealing malware.
## Attack Vector and Tactical Evolution
The threat actors likely gained initial access through removable drives containing malicious .LNK files, a method Gamaredon has employed previously. Notably, the group has evolved its tactics by:
– Shifting from VBS scripts to PowerShell-based tools
– Implementing stronger payload obfuscation
– Increasing use of legitimate services for detection evasion
## Attack Chain Analysis
The infection begins when a user opens a malicious shortcut file (files.lnk) from an external drive. This triggers an obfuscated script that creates two critical files:
1. A command and control (C2) communication handler that resolves server addresses using legitimate services and connects to Cloudflare-protected URLs
2. A spreading mechanism that infects other removable and network drives while hiding compromised folders and system files
The attackers then deploy a reconnaissance PowerShell script that captures screenshots and collects information about antivirus tools, files, and running processes. The final payload—a PowerShell-based version of GammaSteel—is stored directly in the Windows Registry to evade detection.
## Data Exfiltration and Persistence
GammaSteel targets document files (.DOC, .PDF, .XLS, .TXT) from common locations like Desktop, Documents, and Downloads. The malware uses ‘certutil.exe’ to hash files before exfiltrating them via PowerShell web requests. If primary exfiltration fails, it employs cURL over Tor as a backup method. For persistence, the malware adds a new key to the Windows startup registry.
## Security Implications
While Gamaredon is considered less sophisticated than other Russian state actors, their recent tactical improvements and persistent nature pose an increasing threat to Western networks, particularly those with connections to Ukraine’s defense infrastructure.