{ "actor_id": "Gamaredon", "attack_annotations": [ { "name": "Spearphishing Attachment", "tactic": "Initial Access", "technique_id": "T1566.001" }, { "name": "HTML Smuggling", "tactic": "Defense Evasion", "technique_id": "T1027.006" }, { "name": "Exploitation for Client Execution (CVE-2025-8088 WinRAR)", "tactic": "Execution", "technique_id": "T1203" }, { "name": "Registry Run Keys / Startup Folder", "tactic": "Persistence", "technique_id": "T1547.001" }, { "name": "Mshta", "tactic": "Defense Evasion", "technique_id": "T1218.005" }, { "name": "Visual Basic", "tactic": "Execution", "technique_id": "T1059.005" }, { "name": "PowerShell (GammaSteel)", "tactic": "Execution", "technique_id": "T1059.001" }, { "name": "NTFS File Attributes (Alternate Data Streams)", "tactic": "Defense Evasion", "technique_id": "T1564.004" }, { "name": "Scheduled Task", "tactic": "Persistence", "technique_id": "T1053.005" }, { "name": "Web Service: Dead Drop Resolver", "tactic": "Command and Control", "technique_id": "T1102.001" }, { "name": "Application Layer Protocol: Web Protocols", "tactic": "Command and Control", "technique_id": "T1071.001" }, { "name": "Replication Through Removable Media (USB)", "tactic": "Lateral Movement", "technique_id": "T1091" }, { "name": "Exfiltration to Cloud Storage (S3-compatible)", "tactic": "Exfiltration", "technique_id": "T1567.002" } ], "chain": [ { "entity_id": "e001", "review_notes": "HTML smuggling is endpoint defense-evasion (ATT&CK); modeled here only as the user-facing entry artifact.", "role": "entry", "role_confidence": "confirmed", "techniques": [] }, { "entity_id": "e002", "role": "staging", "role_confidence": "confirmed", "technique_confidence": "confirmed", "techniques": [ "IIM-T024" ] }, { "entity_id": "e003", "role": "staging", "role_confidence": "confirmed", "techniques": [] }, { "entity_id": "e004", "review_notes": "www.bbc.com path string is cosmetic log-blending, not a routing technique.", "role": "staging", "role_confidence": "confirmed", "techniques": [] }, { "entity_id": "e005", "review_notes": "GammaLoad updates its registry-cached C2 config via dead-drop resolvers before fetching further VBScript.", "role": "staging", "role_confidence": "confirmed", "technique_confidence": "confirmed", "techniques": [ "IIM-T013" ] }, { "entity_id": "e006", "role": "redirector", "role_confidence": "confirmed", "technique_confidence": "confirmed", "techniques": [ "IIM-T013", "IIM-T006" ] }, { "entity_id": "e007", "role": "redirector", "role_confidence": "confirmed", "technique_confidence": "confirmed", "techniques": [ "IIM-T013", "IIM-T006" ] }, { "entity_id": "e008", "role": "redirector", "role_confidence": "confirmed", "technique_confidence": "confirmed", "techniques": [ "IIM-T013", "IIM-T006", "IIM-T018" ] }, { "entity_id": "e009", "review_notes": "Single entity aggregating additional trusted-platform DDRs (Write.as, Rentry.co, Mastodon).", "role": "redirector", "role_confidence": "confirmed", "technique_confidence": "confirmed", "techniques": [ "IIM-T013", "IIM-T006" ] }, { "entity_id": "e010", "role": "redirector", "role_confidence": "confirmed", "technique_confidence": "confirmed", "techniques": [ "IIM-T005", "IIM-T006" ] }, { "entity_id": "e011", "review_notes": "Cloudflare quick tunnel as ephemeral front; T002 cloud-hosting tagging is the underlying Cloudflare substrate.", "role": "redirector", "role_confidence": "confirmed", "technique_confidence": "likely", "techniques": [ "IIM-T005", "IIM-T002" ] }, { "entity_id": "e012", "review_notes": "Disposable, rapidly rotated operator hosts (~24h lifespan, 55 in 12 days); dynamic-DNS (T008) inferred from the DDR/dynamic-DNS reporting and modeled as likely.", "role": "c2", "role_confidence": "confirmed", "technique_confidence": "likely", "techniques": [ "IIM-T010", "IIM-T011", "IIM-T008" ] }, { "entity_id": "e013", "role": "payload", "role_confidence": "confirmed", "techniques": [] }, { "entity_id": "e014", "role": "payload", "role_confidence": "confirmed", "techniques": [] }, { "entity_id": "e015", "review_notes": "S3-compatible exfiltration endpoint (trusted cloud storage) acting as the data-out C2 sink.", "role": "c2", "role_confidence": "confirmed", "technique_confidence": "confirmed", "techniques": [ "IIM-T002", "IIM-T006" ] }, { "entity_id": "e016", "review_notes": "Operator fallback exfiltration domains; rotation inferred from the broader high-frequency host-rotation pattern.", "role": "c2", "role_confidence": "confirmed", "technique_confidence": "likely", "techniques": [ "IIM-T011" ] } ], "chain_id": "sekoia.2026.gamaredon-gammaworm-matryoshka-ddr-cloudflare-s3", "confidence": "confirmed", "description": "IIM chain for Sekoia.io's three-part 'FSB's matryoshka' Gamaredon series (parts 1-3, 1-4 June 2026) reconstructing a January 2026 infection chain. A weaponized xHTML lure HTML-smuggles a malicious RAR that exploits CVE-2025-8088 to drop a hidden HTA (GammaPhish) into Startup. The HTA runs mshta against an operator URL (padded with a www.bbc.com decoy path) to fetch GammaLoad, an in-memory VBScript loader cascade that resolves and registry-caches its C2 through dead-drop resolvers on graph.org/Telegra.ph, Teletype.in, public Telegram channels, Write.as, Rentry.co, Mastodon and Cloudflare Workers, with Cloudflare quick tunnels fronting the operator origin. The operator runs a rapidly rotated fleet of dedicated hosts (55 servers in 12 days, ~24h average lifespan) that serve VBScript and signal via HTTP 200/404. GammaLoad deploys GammaWorm (propagation) and GammaSteel (fileless PowerShell stealer), which exfiltrates documents to the S3-compatible Tebi.io/AWS S3 with fallback to hard-coded operator domains.", "entities": [ { "evidence": [ "Sekoia (#1) identified a cluster of weaponized xHTML files that use HTML smuggling to drop a malicious RAR archive on the victim.", "Assessed as the GammaPhish initial-access stage." ], "id": "e001", "observed_at": "2026-06-03T00:00:00Z", "source": "Sekoia.io TDR: FSB's matryoshka (#1 GammaPhish/GammaWorm 2026-06-01, #2 GammaLoad 2026-06-03, #3 GammaSteel 2026-06-04)", "type": "file", "value": "Weaponized xHTML lure (HTML smuggling), likely spear-phishing delivered", "x_reference_url": "https://blog.sekoia.io/fsbs-matryoshka-1-3-gamaredons-gifts-that-keeps-unpacking-gammaphish-and-gammaworm/" }, { "evidence": [ "Sekoia (#1) states the RAR exploits CVE-2025-8088 to extract a hidden HTA directly into the Windows Startup directory.", "Archive container delivery abusing a WinRAR path-traversal flaw for Startup-folder placement." ], "id": "e002", "observed_at": "2026-06-03T00:00:00Z", "source": "Sekoia.io TDR: FSB's matryoshka (#1 GammaPhish/GammaWorm 2026-06-01, #2 GammaLoad 2026-06-03, #3 GammaSteel 2026-06-04)", "type": "file", "value": "Malicious RAR archive exploiting CVE-2025-8088 (WinRAR path traversal)", "x_reference_url": "https://blog.sekoia.io/fsbs-matryoshka-1-3-gamaredons-gifts-that-keeps-unpacking-gammaphish-and-gammaworm/" }, { "evidence": [ "Sekoia (#1) states the RAR extracts a hidden HTA into Startup; the HTA runs mshta.exe with a URL whose path contains www.bbc.com to look legitimate in network logs." ], "id": "e003", "observed_at": "2026-06-03T00:00:00Z", "source": "Sekoia.io TDR: FSB's matryoshka (#1 GammaPhish/GammaWorm 2026-06-01, #2 GammaLoad 2026-06-03, #3 GammaSteel 2026-06-04)", "type": "file", "value": "Hidden HTA dropped into the Windows Startup directory (GammaPhish)", "x_reference_url": "https://blog.sekoia.io/fsbs-matryoshka-1-3-gamaredons-gifts-that-keeps-unpacking-gammaphish-and-gammaworm/" }, { "evidence": [ "Sekoia states the HTA runs mshta.exe against a URL embedding www.bbc.com in the path; that URL fetches the GammaLoad staging layer.", "The www.bbc.com string is cosmetic path padding to blend with normal logs, not a redirect through the BBC." ], "id": "e004", "observed_at": "2026-06-03T00:00:00Z", "source": "Sekoia.io TDR: FSB's matryoshka (#1 GammaPhish/GammaWorm 2026-06-01, #2 GammaLoad 2026-06-03, #3 GammaSteel 2026-06-04)", "type": "url", "value": "Operator mshta fetch URL with www.bbc.com decoy path -> retrieves GammaLoad", "x_reference_url": "https://blog.sekoia.io/fsbs-matryoshka-1-3-gamaredons-gifts-that-keeps-unpacking-gammaphish-and-gammaworm/" }, { "evidence": [ "Sekoia (#2) describes GammaLoad as a cascade of VBScript loaders executing loaders entirely in-memory, fingerprinting the host and updating C2 config in the registry (HKCU\\Console) via dead-drop resolvers." ], "id": "e005", "observed_at": "2026-06-03T00:00:00Z", "source": "Sekoia.io TDR: FSB's matryoshka (#1 GammaPhish/GammaWorm 2026-06-01, #2 GammaLoad 2026-06-03, #3 GammaSteel 2026-06-04)", "type": "file", "value": "GammaLoad VBScript loader cascade (4 in-memory stages; MD5 bf94f4056627907d86ce1cae8b44c67a observed)", "x_reference_url": "https://blog.sekoia.io/fsbs-matryoshka-2-3-gamaredons-gifts-that-keeps-unpacking-gammaload/" }, { "evidence": [ "Sekoia states the C2 resolution chain hops through graph.org, Cloudflare Workers, Teletype, Telegra.ph and Telegram before reaching an operator server; each resolved URL is written to the registry.", "Trusted publishing platform used as a dead-drop resolver hosting the current operational endpoint." ], "id": "e006", "observed_at": "2026-06-03T00:00:00Z", "source": "Sekoia.io TDR: FSB's matryoshka (#1 GammaPhish/GammaWorm 2026-06-01, #2 GammaLoad 2026-06-03, #3 GammaSteel 2026-06-04)", "type": "domain", "value": "graph.org (Telegra.ph / Teletype dead-drop resolver)", "x_reference_url": "https://blog.sekoia.io/fsbs-matryoshka-1-3-gamaredons-gifts-that-keeps-unpacking-gammaphish-and-gammaworm/" }, { "evidence": [ "Sekoia lists Teletype/Teletype.in among the dead-drop resolver platforms in the GammaWorm C2 resolution chain." ], "id": "e007", "observed_at": "2026-06-03T00:00:00Z", "source": "Sekoia.io TDR: FSB's matryoshka (#1 GammaPhish/GammaWorm 2026-06-01, #2 GammaLoad 2026-06-03, #3 GammaSteel 2026-06-04)", "type": "domain", "value": "teletype.in (dead-drop resolver)", "x_reference_url": "https://blog.sekoia.io/fsbs-matryoshka-1-3-gamaredons-gifts-that-keeps-unpacking-gammaphish-and-gammaworm/" }, { "evidence": [ "Sekoia states GammaWorm runs curl against a hard-coded public Telegram channel, parses the HTML for an obfuscated IP address, and posts the victim fingerprint back via randomized HTTP headers.", "Public Telegram channel abused as a third-party dead drop that publishes the active C2 IP." ], "id": "e008", "observed_at": "2026-06-03T00:00:00Z", "source": "Sekoia.io TDR: FSB's matryoshka (#1 GammaPhish/GammaWorm 2026-06-01, #2 GammaLoad 2026-06-03, #3 GammaSteel 2026-06-04)", "type": "url", "value": "Hard-coded public Telegram channel used as dead-drop resolver", "x_reference_url": "https://blog.sekoia.io/fsbs-matryoshka-1-3-gamaredons-gifts-that-keeps-unpacking-gammaphish-and-gammaworm/" }, { "evidence": [ "Sekoia (#3) lists dead-drop resolvers hosted on public platforms including Telegram, Telegra.ph, Write.as, Rentry.co and Mastodon, alongside dynamic DNS services.", "Modeled as one entity representing the additional trusted-platform DDRs observed across the infrastructure." ], "id": "e009", "observed_at": "2026-06-03T00:00:00Z", "source": "Sekoia.io TDR: FSB's matryoshka (#1 GammaPhish/GammaWorm 2026-06-01, #2 GammaLoad 2026-06-03, #3 GammaSteel 2026-06-04)", "type": "domain", "value": "write.as / rentry.co / mastodon (additional dead-drop resolver platforms)", "x_reference_url": "https://blog.sekoia.io/fsbs-matryoshka-3-3-gamaredons-gifts-that-keeps-unpacking-gammasteel/" }, { "evidence": [ "Sekoia states the resolution chain hops through Cloudflare Workers; Gamaredon also conceals staging servers behind Cloudflare quick tunnels.", "Serverless edge worker used as an ephemeral resolution/staging node." ], "id": "e010", "observed_at": "2026-06-03T00:00:00Z", "source": "Sekoia.io TDR: FSB's matryoshka (#1 GammaPhish/GammaWorm 2026-06-01, #2 GammaLoad 2026-06-03, #3 GammaSteel 2026-06-04)", "type": "domain", "value": "Cloudflare Workers subdomain (*.workers.dev) used in the resolution chain", "x_reference_url": "https://blog.sekoia.io/fsbs-matryoshka-1-3-gamaredons-gifts-that-keeps-unpacking-gammaphish-and-gammaworm/" }, { "evidence": [ "Sekoia and prior HarfangLab analysis describe Gamaredon's Telegraph/Teletype DDRs typically containing a Cloudflare quick-tunnel address; quick tunnels require no registration and blend with legitimate traffic.", "Ephemeral tunnel front concealing the operator-controlled origin." ], "id": "e011", "observed_at": "2026-06-03T00:00:00Z", "source": "Sekoia.io TDR: FSB's matryoshka (#1 GammaPhish/GammaWorm 2026-06-01, #2 GammaLoad 2026-06-03, #3 GammaSteel 2026-06-04)", "type": "url", "value": "Cloudflare quick tunnel (*.trycloudflare.com) concealing operator staging server", "x_reference_url": "https://blog.sekoia.io/fsbs-matryoshka-1-3-gamaredons-gifts-that-keeps-unpacking-gammaphish-and-gammaworm/" }, { "evidence": [ "Sekoia (#3) states the operator runs dedicated IPs/domains that receive victim fingerprints via HTTP headers and serve VBScript payloads / config updates; HTTP 200 = execute VBScript, HTTP 404 = config update.", "Sekoia mapped 55 new servers provisioned between 16 and 28 January 2026 with an average operational lifespan of ~24 hours, demonstrating high-frequency rotation. The single confirmed C2 IP and full network indicators are in the Sekoia Intelligence feed." ], "id": "e012", "observed_at": "2026-06-03T00:00:00Z", "source": "Sekoia.io TDR: FSB's matryoshka (#1 GammaPhish/GammaWorm 2026-06-01, #2 GammaLoad 2026-06-03, #3 GammaSteel 2026-06-04)", "type": "ip", "value": "Operator-controlled C2 server (dedicated IP/domain; 55 hosts provisioned 16-28 Jan 2026, ~24h average lifespan)", "x_reference_url": "https://blog.sekoia.io/fsbs-matryoshka-1-3-gamaredons-gifts-that-keeps-unpacking-gammaphish-and-gammaworm/" }, { "evidence": [ "Sekoia describes GammaWorm as the propagation component that resolves C2 via the dead-drop resolver chain, stores modules in NTFS ADS, and spreads via USB/network drives using malicious LNK shortcuts." ], "id": "e013", "observed_at": "2026-06-03T00:00:00Z", "source": "Sekoia.io TDR: FSB's matryoshka (#1 GammaPhish/GammaWorm 2026-06-01, #2 GammaLoad 2026-06-03, #3 GammaSteel 2026-06-04)", "type": "file", "value": "GammaWorm (VBScript worm, formerly LitterDrifter/PteroLNK/PterodoUSB; >20,000 lines)", "x_reference_url": "https://blog.sekoia.io/fsbs-matryoshka-1-3-gamaredons-gifts-that-keeps-unpacking-gammaphish-and-gammaworm/" }, { "evidence": [ "Sekoia (#3) describes GammaSteel as a modular PowerShell stealer staging 71 DPAPI-encrypted functions in the registry, hunting documents via drive scans, USB monitoring and active-edit surveillance." ], "id": "e014", "observed_at": "2026-06-03T00:00:00Z", "source": "Sekoia.io TDR: FSB's matryoshka (#1 GammaPhish/GammaWorm 2026-06-01, #2 GammaLoad 2026-06-03, #3 GammaSteel 2026-06-04)", "type": "file", "value": "GammaLoad-deployed GammaSteel (fileless PowerShell stealer; 71 DPAPI-encrypted functions in HKCU\\Printers)", "x_reference_url": "https://blog.sekoia.io/fsbs-matryoshka-3-3-gamaredons-gifts-that-keeps-unpacking-gammasteel/" }, { "evidence": [ "Sekoia (#3) states GammaSteel exfiltrates harvested documents to the legitimate S3-compatible service Tebi.io (and AWS S3), with fallback to hard-coded operator domains.", "Trusted S3-compatible cloud storage abused as the exfiltration endpoint." ], "id": "e015", "observed_at": "2026-06-03T00:00:00Z", "source": "Sekoia.io TDR: FSB's matryoshka (#1 GammaPhish/GammaWorm 2026-06-01, #2 GammaLoad 2026-06-03, #3 GammaSteel 2026-06-04)", "type": "domain", "value": "tebi.io (S3-compatible storage) / AWS S3 exfiltration endpoint", "x_reference_url": "https://blog.sekoia.io/fsbs-matryoshka-3-3-gamaredons-gifts-that-keeps-unpacking-gammasteel/" }, { "evidence": [ "Sekoia (#3) states GammaSteel falls back to hard-coded operator-controlled domains when the S3-compatible exfiltration path is unavailable." ], "id": "e016", "observed_at": "2026-06-03T00:00:00Z", "source": "Sekoia.io TDR: FSB's matryoshka (#1 GammaPhish/GammaWorm 2026-06-01, #2 GammaLoad 2026-06-03, #3 GammaSteel 2026-06-04)", "type": "domain", "value": "Hard-coded operator fallback domains (Russian-nexus) for exfiltration", "x_reference_url": "https://blog.sekoia.io/fsbs-matryoshka-3-3-gamaredons-gifts-that-keeps-unpacking-gammasteel/" } ], "iim_version": "1.1", "import_source": "manual-osint-report-to-iim-conversion", "name": "Gamaredon (UAC-0010) 'Gamma' matryoshka: WinRAR CVE-2025-8088 to multi-platform dead-drop resolvers", "needs_review": false, "observed_at": "2026-06-03T00:00:00Z", "relations": [ { "confidence": "confirmed", "from": "e001", "sequence_order": 1, "to": "e002", "type": "drops", "x_evidence": "The weaponized xHTML uses HTML smuggling to drop the malicious RAR archive." }, { "confidence": "confirmed", "from": "e002", "sequence_order": 2, "to": "e003", "type": "drops", "x_evidence": "The RAR exploits CVE-2025-8088 to extract a hidden HTA into the Windows Startup directory." }, { "confidence": "confirmed", "from": "e003", "sequence_order": 3, "to": "e004", "type": "download", "x_evidence": "The HTA runs mshta.exe against the operator URL (with www.bbc.com decoy path) to fetch GammaLoad." }, { "confidence": "confirmed", "from": "e004", "sequence_order": 4, "to": "e005", "type": "drops", "x_evidence": "The mshta fetch retrieves the GammaLoad VBScript staging layer." }, { "confidence": "confirmed", "from": "e005", "sequence_order": 5, "to": "e006", "type": "references", "x_evidence": "GammaLoad/GammaWorm resolve C2 by hopping through graph.org (Telegra.ph) as a dead-drop resolver." }, { "confidence": "confirmed", "from": "e005", "sequence_order": 6, "to": "e007", "type": "references", "x_evidence": "Teletype.in is part of the dead-drop resolver resolution chain." }, { "confidence": "confirmed", "from": "e005", "sequence_order": 7, "to": "e008", "type": "references", "x_evidence": "GammaWorm runs curl against a hard-coded public Telegram channel and parses the HTML for the obfuscated C2 IP." }, { "confidence": "confirmed", "from": "e005", "sequence_order": 8, "to": "e009", "type": "references", "x_evidence": "Additional trusted-platform dead-drop resolvers (Write.as, Rentry.co, Mastodon) are used across the infrastructure." }, { "confidence": "confirmed", "from": "e005", "sequence_order": 9, "to": "e010", "type": "references", "x_evidence": "The resolution chain also hops through a Cloudflare Workers subdomain." }, { "confidence": "likely", "from": "e010", "sequence_order": 10, "to": "e011", "type": "redirect", "x_evidence": "DDR entries typically contain a Cloudflare quick-tunnel address fronting the operator origin." }, { "confidence": "confirmed", "from": "e006", "sequence_order": 11, "to": "e012", "type": "references", "x_evidence": "The Telegra.ph/graph.org dead-drop resolves to the current operator-controlled C2 server, written to HKCU\\Console." }, { "confidence": "confirmed", "from": "e008", "sequence_order": 12, "to": "e012", "type": "references", "x_evidence": "The Telegram dead drop publishes the active operator C2 IP that GammaWorm extracts." }, { "confidence": "likely", "from": "e011", "sequence_order": 13, "to": "e012", "type": "redirect", "x_evidence": "The Cloudflare quick tunnel forwards to the operator-controlled origin server." }, { "confidence": "likely", "from": "e005", "sequence_order": 14, "to": "e013", "type": "drops", "x_evidence": "GammaWorm is assessed to be dropped concurrently by GammaLoad (or introduced via weaponized USB)." }, { "confidence": "confirmed", "from": "e005", "sequence_order": 15, "to": "e014", "type": "drops", "x_evidence": "The GammaLoad cascade ultimately stages and executes GammaSteel." }, { "confidence": "confirmed", "from": "e013", "sequence_order": 16, "to": "e012", "type": "connect", "x_evidence": "GammaWorm posts the host fingerprint to the operator C2 via randomized HTTP headers; HTTP 200 = execute VBScript, HTTP 404 = config update." }, { "confidence": "confirmed", "from": "e014", "sequence_order": 17, "to": "e015", "type": "connect", "x_evidence": "GammaSteel exfiltrates harvested documents to the S3-compatible service Tebi.io / AWS S3." }, { "confidence": "confirmed", "from": "e014", "sequence_order": 18, "to": "e016", "type": "connect", "x_evidence": "GammaSteel falls back to hard-coded operator domains when the S3-compatible exfiltration path is unavailable." } ], "title": "Gamaredon (UAC-0010) 'Gamma' matryoshka: WinRAR CVE-2025-8088 to multi-platform dead-drop resolvers, Cloudflare and S3 exfiltration", "x_iocs": { "cve": [ "CVE-2025-8088" ], "dead_drop_resolver_platforms": [ "graph.org", "telegra.ph", "teletype.in", "public Telegram channels", "write.as", "rentry.co", "mastodon (instances)", "*.workers.dev (Cloudflare Workers)", "*.trycloudflare.com (Cloudflare quick tunnels)", "dynamic DNS services" ], "exfiltration": [ "tebi.io (S3-compatible)", "AWS S3", "hard-coded operator fallback domains" ], "infrastructure_note": [ "55 operator hosts provisioned 16-28 Jan 2026, ~24h average lifespan; single confirmed C2 IP and full network indicators in the Sekoia Intelligence feed" ], "registry": [ "HKCU\\Console (GammaWorm/GammaLoad C2 cache)", "HKCU\\Printers (GammaSteel 71 DPAPI modules)" ], "sample_md5": [ "bf94f4056627907d86ce1cae8b44c67a (in-memory GammaLoad VBScript)" ] }, "x_limitations": [ "Sekoia publishes a subset of hundreds of IOCs; the complete network indicators (the confirmed operator C2 IP, additional domains/URLs) are distributed via the Sekoia Intelligence feed rather than in full in the blog, so the operator C2 entity is modeled generically.", "The dead-drop resolver platforms (e009) aggregate Write.as, Rentry.co and Mastodon into a single entity for readability; they can be split if per-URL granularity is needed.", "Dynamic-DNS abuse (IIM-T008) on the operator fleet is inferred from the reporting and modeled with likely confidence.", "Endpoint behavior (NTFS ADS module storage, DPAPI registry staging, USB/LNK propagation, scheduled-task persistence) is captured via ATT&CK/evidence rather than IIM techniques." ], "x_publication_safety": "TLP:CLEAR-style OSINT chain derived only from public Sekoia.io reporting; granular network IOCs deliberately not reproduced beyond what Sekoia published openly.", "x_report_published_at": "2026-06-01/2026-06-04 (three-part series)", "x_resource_links_verified": true, "x_selection_reason": "Exceptional IIM fit and unambiguous FSB attribution: archive-container delivery (WinRAR CVE-2025-8088), a layered dead-drop-resolver resolution chain across six+ trusted platforms, Cloudflare Workers/quick-tunnel ephemeral fronting, high-frequency disposable host rotation, and S3-compatible exfiltration. A near-complete tour of the IIM resolution/hosting/composition catalog and a strong reference for dead-drop-resolver modeling.", "x_source": "Sekoia.io Threat Detection & Research (TDR)", "x_source_title": "FSB's matryoshka - Gamaredon's gifts that keep unpacking (GammaPhish/GammaWorm, GammaLoad, GammaSteel)", "x_source_url": "https://blog.sekoia.io/fsbs-matryoshka-1-3-gamaredons-gifts-that-keeps-unpacking-gammaphish-and-gammaworm/", "x_source_urls": [ "https://blog.sekoia.io/fsbs-matryoshka-1-3-gamaredons-gifts-that-keeps-unpacking-gammaphish-and-gammaworm/", "https://blog.sekoia.io/fsbs-matryoshka-2-3-gamaredons-gifts-that-keeps-unpacking-gammaload/", "https://blog.sekoia.io/fsbs-matryoshka-3-3-gamaredons-gifts-that-keeps-unpacking-gammasteel/" ] }