FSB Group Gamaredon Hides Worm in Windows Data Streams
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-8088 | WinRAR Path Traversal (CVE-2025-8088) Enables Arbitrary Code Execution A path traversal flaw (CWE-35) in the Windows version of WinRAR allows attackers to achieve arbitrary code execution by delivering a specially crafted archive file that writes outside the expected location when it is opened or processed. Because the CVSS 4.0 vector indicates a local attack requiring user interaction, victims are typically infected by extracting or previewing a malicious archive received via phishing, a malicious download, or another delivery channel. A successful attacker gains the privileges of the user running WinRAR, providing an initial foothold that has been used for both espionage and ransomware operations. Anyone running the Windows version of WinRAR — one of the most widely deployed Windows desktop utilities — is affected, and CPE data additionally lists dtSearch as an affected vendor. Exploitation is confirmed in the wild by nation-state actors (e.g., the China-linked Amaranth-Dragon group per related reporting) and criminal actors including ransomware operators; the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-08-12 and carries a near-maximal 94.6% EPSS score. Do: Update WinRAR to the latest patched release from RARLAB on all Windows endpoints, prioritizing remediation per CISA KEV and BOD 22-01 requirements, and verify that dtSearch deployments bundling the affected component are also updated. Because exploitation requires a user to open or extract a crafted archive, warn users to treat unexpected archive files delivered by email or download with suspicion. Given confirmed ransomware use, hunt across user workstations — not just exposed servers — for suspicious archive-based infections and confirm the patched WinRAR version is installed. | 8.4 | 95% | KEV ransomware |
| masshundreds of millions of Windows users/devices (est.; RARLAB has historically claimed user counts in the hundreds of millions) |
Full article453 words · extracted from infosecurity-magazine.com · click to collapse
A Russian state-linked worm has been observed hiding its components inside a little-used Windows file feature, allowing it to spread across Ukrainian networks while leaving almost no trace on infected machines.
According to new analysis from Sekoia, the worm is the latest tool of Gamaredon, a long-running espionage group that Ukraine's security service has formally tied to Russia's Federal Security Service (FSB).
The group focuses almost entirely on Ukraine, targeting government, military and critical infrastructure to steal documents and keep long-term access.
Working from artifacts on compromised hosts and more than 70 samples from a partner, the team reconstructed an infection chain seen in January 2026 and still active at the time of writing. The campaign has moved almost entirely to fileless VBScript, a clear step up in stealth from Gamaredon's earlier tooling.
A WinRAR Flaw Drops a Hidden File
The intrusion began with a booby-trapped xHTML file that, once opened, smuggled a malicious RAR archive onto the target's machine. Sekoia tracks this initial-access stage as GammaPhish.
The archive exploited CVE-2025-8088, a path traversal flaw in WinRAR that Google's threat analysts have separately tied to Sandworm, Turla and other Russian operators.
Abusing the bug planted a hidden HTA file in the Windows Startup folder, which ran at the next login and fetched the next payload from a remote server. A decoy PDF kept the victim unaware.
A Worm That Lives in Hidden Streams
GammaWorm is where the campaign's stealth becomes clear, Sekoia explained. Rather than dropping files on disk, the worm hid its modules in NTFS Alternate Data Streams, a native Windows feature that lets data ride alongside an existing file without appearing in standard directory listings.
Once active, it set up persistence through scheduled tasks disguised as routine maintenance and concealed its work by changing registry settings that govern file visibility.
It then propagated to USB sticks and network drives, hiding genuine folders and swapping them for malicious shortcuts that carried provocative Ukrainian-language filenames meant to lure users into opening them.
For command-and-control (C2), GammaWorm pulled live server addresses from legitimate public services, including Telegram and Cloudflare and used them as dead drops before saving the details to the registry. The worm then looped indefinitely as a backdoor, ready to execute whatever code its operators sent.
Sekoia warned that the safest response to infection is a full wipe: "The malware's reliance on Dead Drop Resolvers (DDR) allows it to constantly download fresh payloads, meaning that cleaning attempts often result in fallback mechanisms restoring the malware."
Organizations were also urged to update WinRAR to version 7.13 or later, which closes the flaw.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/gamaredon-worm-ntfs-data-streams/