Threats Tagged 'usb-propagation'

Gamaredon's GammaSteel is a sophisticated infostealer malware used in espionage operations targeting Ukrainian government, military, and critical infrastructure. It operates primarily in memory, leveraging Windows DPAPI encryption and storing multiple payload functions in the registry. The malware collects data through timed drive scans, USB monitoring for air-gapped systems, and real-time file surveillance. Data exfiltration is conducted via legitimate S3-compatible cloud storage with fallback to attacker-controlled servers. The infection chain uses VBScript for evasion and Dead Drop Resolvers on platforms like Telegram and Mastodon for command and control configuration. It includes bidirectional backdoor capabilities allowing arbitrary remote code execution. The attacker infrastructure is highly automated, rotating servers approximately every 24 hours.

MediumMalwareUkraine#vbscript#gammaworm#cyberespionage