Gamarue

Gamarue, sometimes referred to as Andromeda or Wauchos, is a malware family used as part of a botnet. The variant of Gamarue we observe most frequently is a worm that spreads primarily via infected USB drives. Gamarue has been used to spread other malware, steal information, and perform other activities such as click fraud. Despite being disrupted in 2017, it continues to be prevalent and was in the top 10 threats eight times in 12 months in 2024, with new C2 infrastructure observed as of December 2024.