Russian hackers hit military mission in Ukraine with info-stealing malware on external drives

• Symantec says it found GammaSteel on devices belonging to a military operation in Ukraine
• GammaSteel is an infostealer built by Russian cyber-outfit Gamaredon
• Gamaredon is one of many groups on GRU’s payroll

A “military mission of a Western country”, located in Ukraine, was the target of a Russian cyber-espionage attack according to cybersecurity researchers Symantec, who said they identified an attack that started in February 2025 and likely continued until March.

As per the researchers, the attack started with an infected removable drive. This device contained a malicious .LNK file that triggered an infection chain which resulted in the deployment of GammaSteel.