SYMBOLCOMMON_NAMEaka. SYNONYMS
vbs.gamawiper (Back to overview)

GamaWiper

Actor(s): Gamaredon Group


According to ClearSky, this is a VBS-based wiper, deployed via exploitation of a vulnerable WinRAR version (CVE-2025-80880). They assess with medium confidence a link to Gamaredon.

References
2025-11-30Twitter (@ClearskySec)ClearSky
Tweet about GamaWiper
GamaWiper

There is no Yara-Signature yet.