Loading malware…
GammaWorm is a heavily obfuscated VBScript worm in the Gamaredon malware ecosystem, used by the Russia-linked espionage group also tracked as Armageddon, ACTINIUM, Primitive Bear, and UAC-0010. It has been used in campaigns targeting Ukrainian government, military, and critical infrastructure organizations, and supports sustained cyberespionage by enabling propagation, persistence, remote payload execution, and covert command-and-control discovery.
GammaWorm is designed to avoid conventional file artifacts by storing core modules in NTFS Alternate Data Streams and by relying extensively on native Windows scripting and tasking mechanisms. It establishes persistence through scheduled tasks and RunOnce-based execution, and it can modify Windows Explorer settings to reduce visibility of hidden files and extensions. The malware also functions as a stealthy backdoor, periodically contacting operator infrastructure, exfiltrating host fingerprinting data, and retrieving additional VBScript payloads for execution.
A defining feature of GammaWorm is its propagation logic. It spreads through USB drives and network shares by hiding legitimate directories and replacing them with malicious Windows shortcut files that both open the expected folder and silently execute the worm. This behavior supports movement into disconnected or lightly monitored environments, including air-gapped segments reached through removable media. GammaWorm has also been associated with dead-drop resolver chains that abuse public platforms and cloud services to discover active command-and-control endpoints, helping operators blend malicious traffic with legitimate service usage and rapidly rotate infrastructure.
GammaWorm has been observed as part of a broader modular intrusion chain that includes GammaPhish for initial delivery and GammaLoad for staging, with additional payload families such as GammaSteel used for document theft. In reported operations, initial access against Ukrainian targets has involved spearphishing lures and exploitation of CVE-2025-8088 in WinRAR, after which GammaWorm serves as the propagation and persistence component of the compromise.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
According to Sekoia, the attack consists of exploiting the bug CVE-2025-8088, a path traversal bug in WinRAR, to run an HTML App payload called GammaPhish, which is later used to get a VBScript payload from the C2 server.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Gamaredon used GammaPhish, GammaWorm, GammaLoad, and GammaSteel to establish persistence, achieve physical propagation, and steal documents, actively exploiting legitimate Services, cloud storage, and tunneling infrastructure.
23 distinct techniques documented for this family, organized by ATT&CK tactic.
The malware maintains persistence through three scheduled tasks with names borrowed from legitimate Windows services: DiskDiagnosticDataCollector, SilentCleanup, and SmartRetry. Each one executes a different ADS module at short intervals, from 7 to 10 minutes.
resulting in the execution of arbitrary code retrieved from a command-and-control (C2) server
The malware maintains persistence through three scheduled tasks with names borrowed from legitimate Windows services: DiskDiagnosticDataCollector, SilentCleanup, and SmartRetry. Each one executes a different ADS module at short intervals, from 7 to 10 minutes.
Next, to mask its future propagation activities, GammaWorm alters several registry keys within HKEY_USERS\[SID]\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\.
GammaWorm also writes a RunOnce registry key that recreates itself on every user login, because GammaWorm itself rewrites the key before the RunOnce entry gets deleted.
It hides real folders by setting their attributes to Hidden and System, then drops malicious LNK shortcut files in their place using the same folder name and icon. Clicking the LNK opens the real folder in Explorer so the user sees nothing wrong, while silently executing ~.gif, the worm file that sits at the root of every infected drive.
The malware maintains persistence through three scheduled tasks with names borrowed from legitimate Windows services: DiskDiagnosticDataCollector, SilentCleanup, and SmartRetry. Each one executes a different ADS module at short intervals, from 7 to 10 minutes.
GammaWorm also writes a RunOnce registry key that recreates itself on every user login, because GammaWorm itself rewrites the key before the RunOnce entry gets deleted.
It hides real folders by setting their attributes to Hidden and System, then drops malicious LNK shortcut files in their place using the same folder name and icon. Clicking the LNK opens the real folder in Explorer so the user sees nothing wrong, while silently executing ~.gif, the worm file that sits at the root of every infected drive.
The extracted HTA file contains a VBScript blob comprising approximately 90% of junk and obfuscated code.
The module iterates from the root level through all folders. It modifies their attributes to Hidden and System, removing them from the user’s standard view.
Instead it writes its core modules into NTFS Alternate Data Streams, a native Windows feature that lets data sit invisibly attached to a folder path, invisible to standard directory listings and not reflected in file sizes visible to users. | It hides real folders by setting their attributes to Hidden and System, then drops malicious LNK shortcut files in their place using the same folder name and icon.
To find its C2 address, GammaWorm runs curl against a hard-coded public Telegram channel, parses the HTML for an obfuscated IP address... The C2 resolution chain itself is layered: it hops through graph.org, Cloudflare Workers, Teletype, Telegra.ph, and Telegram before arriving at an operator-controlled server.
By using legitimate platforms like Telegram, the idea is to blend in with regular traffic, avoid detection, and sustain long-term espionage operations
Their primary objectives are to fingerprint the host system, update the network configuration in the registry using Dead Drop Resolvers (DDRs), fetch and execute arbitrary VBScript payloads from the C2 servers.
GammaWorm runs a continuous loop that acts as a stealth backdoor, regularly contacting its C2 to exfiltrate system fingerprints...
To find its C2 address, GammaWorm runs curl against a hard-coded public Telegram channel, parses the HTML for an obfuscated IP address, and posts the victim’s machine fingerprint back via randomized HTTP headers, specifically inside the User-Agent string. No request body, just headers.
15 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Worm component in Gamaredon's toolkit used for physical propagation, persistence, and document theft.
Propagation-focused VBScript malware that spreads via USB drives and network shares, stores modules in NTFS Alternate Data Streams, maintains persistence with scheduled tasks and RunOnce abuse, resolves C2 through Telegram-based dead drops, and executes arbitrary VBScript from C2 responses.
A VBScript worm that establishes persistence via scheduled tasks, spreads through network shares and USB drives by replacing directories with malicious LNK files, uses Telegram for C2 resolution, and hides modules using NTFS Alternate Data Streams.
A VBScript worm that establishes persistence via scheduled tasks, propagates through network shares and USB drives by replacing directories with malicious LNK files, uses Telegram for C2 resolution, and conceals modules using NTFS Alternate Data Streams.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.