Russian FSB-Linked Worm Uses Native Windows Feature to Infiltrate Ukrainian Networks

FSB-linked GammaWorm targets Ukrainian systems using hard-to-detect methods; experts advise urgent WinRAR updates to thwart attacks.

By Content Team

Jun 1, 2026

ON THIS PAGE

A Russian state-linked worm tied to the FSB's Gamaredon group is targeting Ukrainian government, military, and critical infrastructure — and it's remarkably hard to detect. Security firm Sekoia reconstructed the active infection chain behind a dozen detections it logged in January 2026.

It starts with a booby-trapped xHTML file. A malicious RAR archive then exploits a WinRAR path traversal flaw, CVE-2025-8088 (CVSS 8.8 High, 8.4 under v4.0), to drop a hidden HTA file into the Startup folder that runs on next login. WinRAR patched this in 7.13 on July 30, 2025, and CISA flagged it as actively exploited weeks later.

The worm, dubbed GammaWorm, hides its modules in NTFS Alternate Data Streams — a native Windows feature that leaves no visible trace in directory listings. It spreads via USB drives and network shares, pulls C2 addresses from Telegram and Cloudflare, and hands off to GammaSteel, a PowerShell stealer that exfiltrates files from local and network drives.

Sekoia recommends a full system wipe for infected machines: the malware constantly pulls fresh payloads from those dead drops, so cleaning attempts usually end with a fallback restoring it. Update WinRAR for Windows to 7.13 or later — anything up to 7.12 is still exposed.

Source: Infosecurity Magazine

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?