Gorbag targets Ukrainian organizations using a WinRAR flaw to steal sensitive data
TL;DR
Russia-aligned group Gorbag is targeting Ukrainian law enforcement and justice bodies, front-line local administrations and the defense sector. It relies on simple infostealers and a reverse shell, and one entry point is the WinRAR flaw CVE-2025-8088, which ESET says leads to a BeautyStealer variant that takes browser data, VPN and RDP configurations and documents. Update WinRAR to close CVE-2025-8088 and treat macro-enabled Office attachments with suspicion.
What happened
Gorbag, a Russia-aligned group active since at least February 2025, is running targeted espionage against Ukrainian organizations, according to ESET. Trend Micro reported the group weaponizing CVE-2025-8088, a now-patched WinRAR flaw, to trigger a DLL sideloading chain that it tied to the GIFTEDCROOK stealer. ESET says that chain actually delivers a BeautyStealer variant.
BeautyStealer, an evolution of GIFTEDCROOK, captures data from Chrome, Edge, Opera and Firefox, plus OpenVPN configurations and files such as Microsoft Office documents, archives, emails, KeePass databases, RDP configurations and VPN configurations. It compresses what it collects, sends it to a Telegram chat or a FastAPI-based C2 server, then removes itself. Since the end of December 2025 the group has used only BeautyStealer variants. Its attacks start with spear-phishing emails carrying malicious attachments and official- or government-themed lures, such as administrative fines or taxes. In one case, a macro-enabled Excel (.XLSM) file ran a VBA payload that decoded and executed BeautyStealer.
Initial attack waves in early 2025 used Prime ReverseShell, a PSSW100AVB derivative that runs commands and returns the results to a C2 server. One reverse shell script variant carries a comment meant to deceive AI assistants into skipping analysis. Testing found it ineffective: two AI assistants still identified the file as a reverse shell.
Why it matters
ESET says Gorbag's targeting closely aligns with Russia's wartime intelligence priorities. Because the stealer also harvests VPN configurations and documents, the group may be acting as an initial access broker that hands stolen data to other actors, who then run their own post-exploitation. If so, ESET says, Gorbag may be only the first stage of a longer intrusion chain. The stealer favors on-off information gathering over persistent access, so hunting for persistence alone may miss it.
Who is affected
- Ukrainian law enforcement and justice entities
- Ukrainian local administrations near the front line
- Ukrainian defense sector
- Staff at targeted organizations running unpatched WinRAR or opening macro-enabled attachments
What to do now
- Update WinRAR to a version that patches
CVE-2025-8088, one of the group's entry points. - Treat macro-enabled Excel (.XLSM) attachments with suspicion, especially official-looking lures about fines or taxes.
- Hunt for processes bulk-reading VPN, OpenVPN and RDP configurations, KeePass databases and Office files, then archiving them for upload.
- Watch for unusual outbound traffic to Telegram or FastAPI-based C2 endpoints.
What we don't know yet
- Whether Gorbag is acting as an initial access broker, and whether other actors have used the stolen VPN configurations and documents for later intrusion stages.
- The total number of successful victims and the scale of the operation.
Sources
