---
title: Russian FSB-Linked Worm Uses Native Windows Feature to Infiltrate Ukrainian Networks
description: FSB-linked GammaWorm targets Ukrainian systems using hard-to-detect methods; experts advise urgent WinRAR updates to thwart attacks.
canonical_url: https://codekeeper.co/ticker/fsb-gammaworm-targets-ukraine
---

# Russian FSB-Linked Worm Uses Native Windows Feature to Infiltrate Ukrainian Networks

FSB-linked GammaWorm targets Ukrainian systems using hard-to-detect methods; experts advise urgent WinRAR updates to thwart attacks.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Jun 1, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffsb-gammaworm-targets-ukraine%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffsb-gammaworm-targets-ukraine%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffsb-gammaworm-targets-ukraine%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffsb-gammaworm-targets-ukraine%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffsb-gammaworm-targets-ukraine%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffsb-gammaworm-targets-ukraine%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

A Russian state-linked worm tied to the FSB's Gamaredon group is targeting Ukrainian government, military, and critical infrastructure — and it's remarkably hard to detect. Security firm Sekoia reconstructed the active infection chain behind a dozen detections it logged in January 2026. It starts with a booby-trapped xHTML file. A malicious RAR archive then exploits a WinRAR path traversal flaw, CVE-2025-8088 (CVSS 8.8 High, 8.4 under v4.0), to drop a hidden HTA file into the Startup folder that runs on next login. WinRAR patched this in 7.13 on July 30, 2025, and CISA flagged it as actively exploited weeks later. The worm, dubbed GammaWorm, hides its modules in NTFS Alternate Data Streams — a native Windows feature that leaves no visible trace in directory listings. It spreads via USB drives and network shares, pulls C2 addresses from Telegram and Cloudflare, and hands off to GammaSteel, a PowerShell stealer that exfiltrates files from local and network drives. Sekoia recommends a full system wipe for infected machines: the malware constantly pulls fresh payloads from those dead drops, so cleaning attempts usually end with a fallback restoring it. Update WinRAR for Windows to 7.13 or later — anything up to 7.12 is still exposed. **Source:** [Infosecurity Magazine](https://www.infosecurity-magazine.com/news/gamaredon-worm-ntfs-data-streams/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffsb-gammaworm-targets-ukraine%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffsb-gammaworm-targets-ukraine%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffsb-gammaworm-targets-ukraine%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffsb-gammaworm-targets-ukraine%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffsb-gammaworm-targets-ukraine%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffsb-gammaworm-targets-ukraine%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Cyberattacks Suspected North Korean Hackers Targeted Popular Rust Packages in Supply Chain Attack Aug 24, 2026](https://codekeeper.co/ticker/suspected-north-korean-hackers-target-rust-ecosystem)

[BlackFile Cybercrime Group Targets Financial Giants with $3M Extortion Demands Aug 21, 2026](https://codekeeper.co/ticker/blackfile-cybercrime-targets-financial-firms)

[KnowledgeDeliver LMS Zero-Day Used to Deploy Stealthy In-Memory Web Shell Aug 13, 2026](https://codekeeper.co/ticker/zero-day-flaw-in-knowledgedeliver-lms)

[Data breaches McKesson Confirms Data Breach as ShinyHunters Threatens to Leak 284 Million Records Sep 1, 2026](https://codekeeper.co/ticker/mckesson-data-breach-shinyhunters-extortion)