FSB-linked Gamaredon group uses multi-stage GammaLoad malware chain to target Ukraine

Summary

Sekoia.io's investigation reveals how Gamaredon, an FSB-linked cyber espionage group targeting Ukraine, employs a multi-stage malware chain called GammaLoad. The operation uses loaders, droppers, and registry-cached C2 configurations to maintain stealthy, persistent access. The group abuses trusted services like Telegram, Telegraph, Cloudflare, and Check-Host to retrieve payloads and ultimately deliver the GammaSteel malware.

Source

bskyFSB-linked Gamaredon group uses multi-stage GammaLoad malware chain to target Ukrainehendryadrian.com