Shuckworm Revives GammaSteel to Spy on Ukraine

A recent cyber-espionage campaign by the Russia-linked Shuckworm group targeted a Western military mission in Eastern Europe, focusing on Ukraine. The attack began in late February 2025 and used an updated version of their GammaSteel malware delivered via a malicious LNK file on a USB drive. The malware leveraged legitimate tools to stay hidden while storing payloads within the registry to avoid detection. The campaign highlights Shuckworm’s evolving tactics and continued focus on intelligence gathering.