QuietSieveMalware
According to Microsoft, this is a heavily obfuscated. NET malware, primarily geared towards the exfiltration of data from the compromised host. But it can also receive and execute a remote payload from the operator.From MISP Galaxy
Last reported 4 months ago, by Sekoia.io1 report
ATT&CK techniques
5 techniques · each with the sentence it comes from- T1027.006HTML Smuggling
“Next, it initiates a HTML Smuggling technique with a Base64-encoded RAR archive embedded in its source code, named 2_14_6_1033_09.12.2025.rar and exploiting CVE-2025-8088.”
- T1036Masquerading
“To maintain a resilient connection with C2 server, GammaWorm establishes a persistence mechanism masquerading as a system maintenance tool.”
- T1053.005Scheduled Task
“It establishes persistence via scheduled tasks and actively conceals its core modules within NTFS Alternate Data Streams (ADS).”
- T1546.013PowerShell Profile
“…to achieve remote code execution if a file is written to specific locations, such as persistence paths (e.g., Programs\Startup) as PowerShell profile, or by replacing a DLL to exploit a DLL search order hijacking vulnerability.”
- T1684Social Engineering
“…itimate directories, replacing them with malicious LNK shortcut files, and forge a second type of LNK shortcuts that use Ukrainian social engineering lures.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
FSB’s matryoshka #1/3: Inside Gamaredon Cyber Operations“…2, the Microsoft Threat Intelligence Center (MSTIC) categorised these payloads as distinct families, notably PowerPunch (a loader) and QuietSieve (a stealer).”
Indicators in its reports
named in the reports above- mil.gov[.]uain 1 report
- teletype[.]inin 1 report
- 1794369214b7f62e70a0485e61335c61in 1 report
- hxxp://iiwdsxwamylbwwsoyrmj.supabase[.]co/functions/v1/clever-responder/KokonGoogle_09.12.2025in 1 report
- hxxps://[email redacted][.]co/functions/v1/clever-responder/GurGoogle_09.12.2025/audience/capture.pdfin 1 report
- 8e1624d110c090ff57d4b493a9107c66in 1 report
- hxxps://graph[.]org/in 1 report
- graph[.]orgin 1 report
- 104.194.140[.]6in 1 report
- moment-cat-qld-place.trycloudflare[.]comin 1 report
- shellobject[.]runin 1 report
- hxxps://www.telegram[.]me/s/oberfaririn 1 report
- gov[.]tkin 1 report
- gov[.]skin 1 report
- net[.]uain 1 report
- mfa.gov[.]uain 1 report
- gov[.]trin 1 report
- hxxps://efficiency-planes-emotions-fascinating.trycloudflare[.]com/@myrain/Xh1Lta2Ccro?84wtj9ob-01-31in 1 report
- efficiency-planes-emotions-fascinating.trycloudflare[.]comin 1 report
- hxxps://efficiency-planes-emotions-fascinating.trycloudflare[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.