CERT24Pro-Russian group Gamaredon uses WinRAR to deliver malware in UkraineLoading data…
CERT24Threat Observatory
Period

Pro-Russian group Gamaredon uses WinRAR to deliver malware in Ukraine

Gamaredon has continued exploiting WinRAR vulnerability CVE-2025-8088 to deliver GammaPhish, GammaLoad, GammaWorm, and GammaSteel against Ukraine. The infection chain was observed in January 2026.

← Back to intelligence

Pro-Russian group Gamaredon uses WinRAR to deliver malware in Ukraine

Gamaredon has continued exploiting WinRAR vulnerability CVE-2025-8088 to deliver GammaPhish, GammaLoad, GammaWorm, and GammaSteel against Ukraine. The infection chain was observed in January 2026.