Gorbag targets Ukrainian organizations using a WinRAR flaw to steal sensitive data
Russia-aligned group Gorbag is targeting Ukrainian law enforcement and justice bodies, front-line local administrations and the defense sector. It relies on simple infostealers and a reverse shell, and one entry point is the WinRAR flaw CVE-2025-8088, which ESET says leads to a BeautyStealer variant that takes browser data, VPN and RDP configurations and documents. Update WinRAR to close CVE-2025-8088 and treat macro-enabled Office attachments with suspicion.
CVE-2025-80882 min