Gamaredon’s GammaPhish & GammaWorm: Stealthy USB‑Spreading Toolkit Targeting Ukraine
Sekoia’s Threat Detection & Research team maps Gamaredon’s GammaPhish and GammaWorm toolkit, showing how the Russian‑linked group hides malicious code in legitimate Windows features and trusted services like Telegram and Cloudflare. The analysis reveals a multi‑stage, USB‑spreading infection chain designed for long‑term espionage against Ukrainian government and infrastructure.