Loading malware…
GamaWiper is a Windows wiper associated with the Russian state-linked Gamaredon threat actor, also tracked as Armageddon, Shuckworm, ACTINIUM, and UAC-0010. It emerged in late 2025 in operations targeting Ukrainian organizations, including military, governmental, political, and administrative entities, and has been cited as evidence of Gamaredon expanding from long-running espionage activity into destructive attacks.
Reporting links GamaWiper to intrusion chains in which Gamaredon abused WinRAR path traversal vulnerabilities, including CVE-2025-8088 and CVE-2025-6218, to achieve code execution and deploy malicious Visual Basic Script-based payloads. Delivery has been associated with phishing and spearphishing campaigns using malicious archive files, and broader Gamaredon tradecraft in the same period also included weaponized document and script-based lures. The malware is described specifically as a data-wiping capability rather than an espionage implant or persistence-focused backdoor.
High-confidence public reporting attributes GamaWiper to destructive operations against Ukrainian targets with medium-confidence attribution in some reporting streams, but the overall association with Gamaredon is consistent. Available information supports classifying it as a destructive Windows malware component used in targeted campaigns rather than a broadly distributed criminal tool.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
According to Sekoia, the attack consists of exploiting the bug CVE-2025-8088, a path traversal bug in WinRAR, to run an HTML App payload called GammaPhish, which is later used to get a VBScript payload from the C2 server.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Alternative spelling/name for the destructive wiper later normalized in this report as GammaWipe.
A named Gamaredon-associated wiper referenced in the source list.
GamaWiper is a destructive wiper malware deployed by Gamaredon, marking a shift from espionage to destructive operations.
GamaWiper is a destructive wiper malware deployed by Gamaredon, marking a shift from espionage to destructive operations.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.