Shuckworm Group Uses PowerShell Based GammaSteel Malware in Targeted Attacks

This latest campaign, observed from February through March 2025, represents an evolution in the group’s tactics with a shift toward more sophisticated PowerShell-based malware tools that enhance stealth and persistence capabilities. This tactical shift allows the group to leverage PowerShell for increased obfuscation and provides the capability to store malicious scripts directly in the Windows Registry, reducing their footprint on disk. Analysis of the infection timeline shows that following initial compromise in February, an array of malicious activity occurred on March 1st across multiple machines in the targeted network. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. A sophisticated malware campaign utilizing the notorious ViperSoftX malware has been targeting users through cracked software and torrent downloads since early April 2025. The initial infection vector in this campaign appears to be infected removable drives, demonstrating the group’s tactical awareness of potential airgapped environments in military settings. The Russia-linked espionage group Shuckworm has continued its relentless focus on Ukraine into 2025, with new attacks targeting a Western country’s military mission based in Eastern Europe. Symantec researchers identified a complex, multi-staged attack chain featuring frequent use of obfuscation techniques designed to minimize detection risk. For data exfiltration, GammaSteel employs multiple methods including PowerShell web requests to Cloudflare-based domains, and as a fallback, cURL with Tor network proxying to mask the origin IP. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. The attack begins with a malicious LNK file on an external drive, which triggers a chain of events starting with an mshta.exe process executing JavaScript code. The campaign demonstrates Shuckworm’s move from VBS scripts to predominantly PowerShell-based tools, particularly in later stages of the attack chain. Tushar is a Cyber security content editor with a passion for creating captivating and informative content.

This Cyber News was published on cybersecuritynews.com. Publication date: Sun, 13 Apr 2025 00:50:11 +0000