Gamaredon GammaSteel & Argamal: Surge in Multi-Vector Infostealer Campaigns

---
title: Potential Argamal Persistence via COM Hijacking
id: 0a1b2c3d-4e5f-6789-0abc-1def23456789
status: experimental
description: Detects registry modifications to the InprocServer32 entry for the Windows Color System Calibration Loader, a technique used by Argamal malware for persistence.
references:
    - https://otx.alienvault.com/pulse/66000000/
author: Security Arsenal Research
date: 2026/06/06
modified: 2026/06/06
tags:
    - attack.persistence
    - attack.t1546.015
logsource:
    product: windows
    registry:
        - set
detection:
    selection:
        TargetObject|contains: '\CLSID\{1ACC0528-2B65-4F80-9096-C5545FDD4271}\InprocServer32\(default)'
    condition: selection
falsepositives:
    - Unknown
level: critical
---
title: Gamaredon Group GammaSteel Registry Persistence
id: 1b2c3d4e-5f67-890a-bcde-f1234567890a
status: experimental
description: Detects the creation or modification of registry values in the HKCU\Printers key, associated with Gamaredon's GammaSteel infostealer storing payload functions.
references:
    - https://otx.alienvault.com/pulse/66000005/
author: Security Arsenal Research
date: 2026/06/06
modified: 2026/06/06
tags:
    - attack.persistence
    - attack.t1114.001
logsource:
    product: windows
    registry:
        - set
detection:
    selection:
        TargetObject|contains: 'Software\Microsoft\Windows NT\CurrentVersion\Printers\'
    filter_generic:
        Details|contains: 'PrinterData'
    condition: selection and not filter_generic
falsepositives:
    - Legitimate printer driver installation
level: high
---
title: Suspicious PowerShell Download via ClickFix Lures
id: 2c3d4e5f-6789-0abc-def1-234567890abc
status: experimental
description: Detects PowerShell commands attempting to download payloads from suspicious domains or utilizing encoding often used in ClickFix campaigns targeting macOS/Windows utilities.
references:
    - https://otx.alienvault.com/pulse/66000003/
author: Security Arsenal Research
date: 2026/06/06
modified: 2026/06/06
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: process_creation
detection:
    selection_pwsh:
        Image|endswith: '\powershell.exe'
    selection_cmd:
        CommandLine|contains:
            - 'Invoke-WebRequest'
            - 'IEX'
            - 'DownloadString'
    selection_suspicious:
        CommandLine|contains:
            - 'jihiz.com'
            - 'kayeart.com'
            - 'bintail.com'
            - 'malext.com'
            - 'pixeldrain'
    condition: all of selection_*
falsepositives:
    - Administrator scripts
level: high

// Hunt for network connections to IOCs from OTX Pulses
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl in~ ("guiformat.com", "forestoaker.com", "jihiz.com", "kayeart.com", "bintail.com", "wusetail.com", "malext.com", "miappl.com", "pla7ina.cfd", "vagturk.com", "justsstop.ru")
   or RemoteIP in ("194.150.220.218", "217.156.122.75", "165.22.170.129")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| summarize count() by RemoteUrl, RemoteIP, DeviceName
| order by count_ desc

<#
.SYNOPSIS
    IOC Hunt Script for Argamal and GammaSteel Persistence.
.DESCRIPTION
    Checks for specific registry modifications associated with Argamal (COM Hijacking)
    and Gamaredon Group (GammaSteel) based on OTX Pulse data.
#>

function Check-ArgamalPersistence {
    $clsidPath = "Registry::HKLM\SOFTWARE\Classes\CLSID\{1ACC0528-2B65-4F80-9096-C5545FDD4271}\InprocServer32"
    if (Test-Path $clsidPath) {
        $defaultVal = (Get-ItemProperty -Path $clsidPath -ErrorAction SilentlyContinue).'(default)'
        # Legitimate default is usually C:\Windows\System32\mscms.dll
        if ($defaultVal -ne "C:\Windows\System32\mscms.dll" -and $defaultVal -ne $null) {
            Write-Host "[!] SUSPICIOUS: Argamal COM Hijacking detected at $clsidPath"
            Write-Host "    Value: $defaultVal"
        }
    }
}

function Check-GammaSteelPersistence {
    $printersPath = "Registry::HKCU\Printers"
    # GammaSteel stores payload functions in this key, checking for unusual binary data or specific keys
    # This is a heuristic check for non-standard entries
    if (Test-Path $printersPath) {
        $subKeys = Get-ChildItem -Path $printersPath -Recurse -ErrorAction SilentlyContinue
        foreach ($key in $subKeys) {
            $props = Get-ItemProperty -Path $key.PSPath -ErrorAction SilentlyContinue
            foreach ($prop in $props.PSObject.Properties) {
                if ($prop.Name -notlike 'PS*' -and $prop.Value -is [byte[]]) {
                     Write-Host "[!] SUSPICIOUS: Binary data detected in HKCU\Printers at $($key.Name)"
                     Write-Host "    Property: $($prop.Name)"
                }
            }
        }
    }
}

Check-ArgamalPersistence
Check-GammaSteelPersistence