{
  "Event": {
    "analysis": "1",
    "date": "2026-06-03",
    "extends_uuid": "",
    "info": "[Threat Intel] FSB\u2019s matryoshka #2/3 \u2013 Gamaredon\u2019s gifts that keeps unpacking \u2013 GammaLoad",
    "protected": false,
    "publish_timestamp": "1780629672",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1780629672",
    "uuid": "1a8677ce-66e4-45f6-83b0-525be67118ff",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#d3e17d",
        "local": false,
        "name": "misp-galaxy:producer=\"Sekoia\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#705cef",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#bb2745",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Standard Encoding - T1132.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#56c932",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Symmetric Cryptography - T1573.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#2c1d2e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Checks - T1497.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#edf46c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Timestomp - T1070.006\"",
        "relationship_type": ""
      },
      {
        "colour": "#1b0fe1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Masquerade Task or Service - T1036.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#9e0269",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Service - T1102\"",
        "relationship_type": ""
      },
      {
        "colour": "#755c09",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#b76d96",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#6e0b83",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Regsvr32 - T1218.010\"",
        "relationship_type": ""
      },
      {
        "colour": "#d82db7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Query Registry - T1012\"",
        "relationship_type": ""
      },
      {
        "colour": "#9db548",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Domain Fronting - T1090.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#98f3da",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Visual Basic - T1059.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#4c0fbb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "relationship_type": ""
      },
      {
        "colour": "#8bde06",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"NTFS File Attributes - T1564.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#e4d611",
        "local": false,
        "name": "misp-galaxy:target-information=\"Ukraine\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:threat-actor=\"Gamaredon Group\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#1c006d",
        "local": false,
        "name": "rectifyq:topic=\"geopolitical\"",
        "relationship_type": ""
      },
      {
        "colour": "#f1dfed",
        "local": false,
        "name": "rectifyq:TA-category=\"APT\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#31373d",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"not-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780570841",
        "to_ids": false,
        "type": "link",
        "uuid": "1e4adde7-f3d3-4a73-9b41-ad9cee7da290",
        "value": "https://blog.sekoia.io/fsbs-matryoshka-2-3-gamaredons-gifts-that-keeps-unpacking-gammaload/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780570841",
        "to_ids": false,
        "type": "text",
        "uuid": "609a05eb-5d38-4f87-92a5-61c4438a42b8",
        "value": "Gamaredon, an FSB-operated cyberespionage group, continues targeting Ukrainian government, military, and critical infrastructure through sophisticated multi-stage infection chains. This analysis examines GammaLoad, a collection of VBScript loaders that establish continuous access through three distinct stages. The malware leverages Dead Drop Resolvers on legitimate platforms including Telegram, Telegraph, and Check-Host to maintain persistent C2 communications while storing configurations in Windows registry keys. Each stage employs different techniques: the first fingerprints hosts and uses failover mechanisms, the second writes payloads to Alternate Data Streams and establishes persistence via scheduled tasks, and the third executes obfuscated PowerShell to deliver the final GammaSteel payload. This matryoshka architecture enables operators to deploy arbitrary payloads while remaining largely invisible by abusing trusted Windows features and cloud platforms."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780570841",
        "to_ids": false,
        "type": "text",
        "uuid": "57171f4f-1ef9-4c97-ae30-ccb46d51aaa9",
        "value": "Name: FSB\u2019s matryoshka #2/3 \u2013 Gamaredon\u2019s gifts that keeps unpacking \u2013 GammaLoad\nAuthor: AlienVault\nAdversary: Gamaredon\nTags: [\"gammaload\", \"gammasteel\", \"gammawipe\", \"gammaworm\", \"gammaphish\", \"gamaredon\", \"fsb\"]\nTgtd countries: [\"Ukraine\"]\nMlwr families: [\"GammaLoad\", \"GammaPhish\", \"GammaWorm\", \"GammaSteel\", \"GammaWipe\"]\nAttack_ids: [\"T1053.005\", \"T1132.001\", \"T1573.001\", \"T1497.001\", \"T1082\", \"T1140\", \"T1070.006\", \"T1036.004\", \"T1102\", \"T1059.001\", \"T1547.001\", \"T1027\", \"T1218.010\", \"T1012\", \"T1090.004\", \"T1071.001\", \"T1059.005\", \"T1105\", \"T1564.004\"]\nIndustries: [\"Government\", \"Defense\"]"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780570841",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "1f346599-7e7e-4fb0-81ea-649f0147a8c7",
        "value": "Gamaredon"
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:05/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780623545",
        "to_ids": true,
        "type": "md5",
        "uuid": "f3f01e9b-7637-4920-b39b-0ef616c200c4",
        "value": "a2c6e01001c62f6198e31a9d603977c6",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:05/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780623546",
        "to_ids": true,
        "type": "md5",
        "uuid": "4d0a115d-5a90-4314-a5b8-c8ff64e76011",
        "value": "bf94f4056627907d86ce1cae8b44c67a",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:05/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780623547",
        "to_ids": true,
        "type": "md5",
        "uuid": "3759943c-ab4c-45bb-83e0-551d1a83441f",
        "value": "d2a6009587b3cb73355c2d1e53d5cdfa",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780627082",
        "to_ids": true,
        "type": "url",
        "uuid": "01c9a32d-0e3c-4b2e-924a-0538e92150bb",
        "value": "https://insight-sweet-drainage-appreciated.trycloudflare.com/log",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780627104",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5a5d2b11-8bda-4c6d-b0dc-7531b74077eb",
        "value": "insight-sweet-drainage-appreciated.trycloudflare.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780627125",
        "to_ids": true,
        "type": "url",
        "uuid": "1b8bbec9-8390-4e2a-a37a-6180b4fe5a31",
        "value": "https://telegram.me/s/oberfarir",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780627146",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "b3632ed0-bbc9-4bc6-a119-59432d75987f",
        "value": "172.86.76.132",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}