GammaSteel is an advanced infostealer deployed by the FSB-operated Gamaredon group targeting Ukrainian government and critical infrastructure. It runs mostly from memory, using Windows DPAPI encryption and storing 71 payload functions in the HKCU\Printers registry key. The malware employs three concurrent data acquisition methods: scheduled drive scans, USB device monitoring to compromise air-gapped systems, and real-time file surveillance. Exfiltration occurs through legitimate S3-compatible cloud storage (Tebi.io) with fallback to operator-controlled servers. The infection chain heavily relies on VBScript for evasion and uses Dead Drop Resolvers on Telegram and Mastodon for C2 configuration. It also features a bidirectional backdoor enabling arbitrary remote code execution. The attacker infrastructure is highly automated, with server rotation approximately every 24 hours.

The malware enables extensive espionage capabilities including data theft from targeted systems, persistence, and remote code execution. It targets sensitive Ukrainian government, military, and critical infrastructure entities, potentially compromising confidential information and operational security. The use of memory-resident techniques and legitimate cloud services for exfiltration complicates detection and mitigation.

No official patch or remediation is indicated in the provided data. Patch status is not yet confirmed — check the vendor advisory or trusted threat intelligence sources for current remediation guidance. Defenders should focus on detecting indicators of compromise such as the known domains (justsstop.ru) and IP addresses (165.22.170.129), monitor for unusual VBScript execution, and scrutinize registry keys under HKCU\Printers for suspicious payloads. Network monitoring for connections to S3-compatible cloud storage services like Tebi.io and use of Dead Drop Resolvers on Telegram or Mastodon may also help identify infections. Given the malware's use of USB propagation, controlling removable media use and scanning devices is advisable.