Loading malware…
GammaDrop is a malware component used in intrusion campaigns attributed to the Russian state-aligned Gamaredon cluster, also tracked as Shuckworm, Armageddon, BlueAlpha, and UAC-0010. It is used primarily against Ukrainian organizations, including state institutions, as part of long-running cyber-espionage activity. Reporting places GammaDrop in active spearphishing operations that used spoofed or compromised email accounts and, in later campaigns, HTML smuggling and staged delivery infrastructure concealed through Cloudflare Tunnel services. GammaDrop has also been referenced in infection chains associated with exploitation of CVE-2025-8088.
Functionally, GammaDrop serves as a dropper in the Gamaredon toolchain. Its documented role is to write GammaLoad to disk and establish persistence on the compromised system, enabling follow-on execution of the next-stage malware. In these campaigns, GammaLoad is the downstream payload associated with beaconing, additional malware execution, credential theft, and data exfiltration, making GammaDrop an enabling stage in a broader espionage workflow rather than the principal collection implant itself.
GammaDrop is associated with Windows-focused intrusion chains and has been observed in targeted delivery operations rather than indiscriminate mass malware distribution. The malware’s operational context reflects Gamaredon’s emphasis on persistent access, evasive infrastructure, and repeated phishing waves against Ukrainian government and related entities.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Gamaredon’s infection chain: Spoofed emails, GammaDrop and GammaLoadIdentifier
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Gamaredon’s infection chain: Spoofed emails, GammaDrop and GammaLoad
GammaDrop: acts as a dropper, writing GammaLoad to disk and ensuring persistence
9 distinct techniques documented for this family, organized by ATT&CK tactic.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Gamaredon dropper component used in the infection chain alongside GammaLoad.
Malware used by Gamaredon in spear-phishing campaigns; infrastructure concealed using Cloudflare Tunnels and DNS fast-flux.
Named as part of Gamaredon’s infection chain in a spearphishing campaign abusing CVE-2025-8088 against Ukrainian state institutions.
Named malware used in Gamaredon’s infection chain, referenced as part of spearphishing activity targeting Ukrainian state institutions.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.