There are the cyberattacks that make the headlines, with ransomware paralyzing hospitals or dramatic power outages. And then there are the quieter ones, the far more stealthy intrusions that aim to stay invisible for years.
It is in this second category that Gamaredon operates, a hacking group that Ukrainian authorities attribute directly to the FSB, the successor to the KGB. Its targets: Ukrainian government agencies, the military, and critical infrastructure, spied on relentlessly for more than a decade.
What worries researchers today is not so much the target’s novelty as the sophistication of the camouflage.
In a highly detailed investigation, the French firm Sekoia.io, which monitors hacker groups tied to states, describes how Gamaredon has nearly abandoned homegrown hacking tools to nestle inside services like Telegram, the Cloudflare infrastructure, or the WinRAR file-compression software installed on millions of computers worldwide.
A USB drive or a forged email as the entry point
As expected, it all begins with an email.
Researchers at Sekoia intercepted a poisoned document sent to victims, which opens a RAR archive. Bad news for laggards: this archive exploits a critical WinRAR vulnerability (CVE-2025-8088), patched by the vendor in August 2025, but evidently not yet fixed everywhere.
According to Google Threat Intelligence, this same flaw has also been used by other Russian hacking groups such as Sandworm and Turla, as well as by Chinese groups.
The vulnerability allows the attacker to drop a malicious file directly into the Windows startup folder without the user noticing. On the next reboot, the trap closes itself automatically.
Once the machine is infected, the spyware can also propagate physically by infecting USB drives connected to the device. It’s a formidable technique to reach so‑called “air-gapped” networks, those systems deliberately kept offline from the Internet.
Telegram and Cloudflare as covert command channels
The most striking element of the investigation concerns how the operators drive their software remotely.
Rather than relying on easily discoverable and blockable servers, Gamaredon has chosen to hide its instructions on platforms that security systems are accustomed to letting through without question.
The spyware will thus fetch a publicly accessible Telegram page, reachable even without an account or the app installed, to retrieve a coded address.
It does the same with Telegra.ph, Telegram’s article-publishing tool, with Teletype, another blog platform, and with free subdomains hosted on Cloudflare’s infrastructure.
At every step, a new address is pulled and stored in the Windows registry of the infected machine, forming a relay chain that is almost impossible to cut with a single strike. Blocking just one channel is not enough, as the others immediately take over.
This technique, dubbed “Dead Drop Resolvers” by specialists, drawing on the Cold War era concept of dead-letter boxes, lets the operators in Russia continuously reconfigure their command-and-control infrastructure on the fly, without ever having to resend a new piece of software to their victims.
A worm hiding in the corners of the hard drive
To ensure its survival, the malware—referred to by researchers as GammaWorm to straighten out the chaotic naming of these threats—exploits a little-known Windows filesystem feature: Alternate Data Streams.
Originally designed to support compatibility with old Macintosh computers, this feature allows data to be attached invisibly to a file or folder without appearing in File Explorer or changing the apparent size of the directory.
In other words, it’s a vault hidden in the wall that only a very specific command can reveal.
The spyware also installs through scheduled tasks bearing deliberately innocuous, technical names (DiskDiagnosticDataCollector, SilentCleanup) intended to evoke Windows maintenance utilities rather than espionage tools.
On USB drives and network shares, the method becomes particularly insidious. The malware makes legitimate user folders invisible and replaces them with fake shortcuts bearing exactly the same name and icon.
Clicking these traps opens the original folder, giving the illusion that everything is normal while quietly executing the spyware in the background.
Decoys that prey on the fears of war
To coax users into opening the correct files, the attackers lean on social engineering, exploiting the latest grim news from the targeted country.
Sekoia researchers found lure file names in Ukrainian referencing military conscription, lists of equipment for soldiers killed in action, or documents allegedly classified. Some file names, more shocking, exploit explicit content to push the victim to open the trap out of morbid curiosity.
The most troubling aspect highlighted by researchers is the very architecture of the operation: each infection step constitutes a complete back door in itself. In other words, even if a victim manages to delete part of the malware, any remaining component is enough for the operators to regain control, download new tools, and continue the espionage.
Sekoia additionally urges organizations affected to perform a full reinstall of infected machines rather than merely cleaning, a lesson deemed insufficient given the system’s redundancy.
The investigation underscores a broader pattern of Russian intelligence activity, documented by several Western cybersecurity agencies. As “homebrew” hacking tools become easier to detect, intelligence services favor techniques that hide within ordinary corporate and personal traffic.
