Russia-linked Gorbag targets Ukraine war support
Gorbag steals data from Ukrainian defense and law enforcement using phishing and WinRAR exploit.
75
- Mentions · 7d3
- Mentions · 30d3
- All mentions3
- First seenNov 3, 2026
- Last mentioned2h ago
Timeline
3 articles · newest firstRussia-Aligned Gorbag Hackers Use WinRAR Flaw for Data-Stealing Malware
Gorbag deploys BeautyStealer after exploiting a now-patched WinRAR flaw in attacks on Ukrainian targets.
55
Gorbag APT group targets Ukrainian organizations with self-deleting malware
Gorbag APT uses BeautyStealer that erases itself after collecting credentials from Ukrainian law enforcement, city councils and defense entities.
75
Related CVEs
by mentions- CVE-2025-808894%8.4WinRAR Path Traversal (CVE-2025-8088) Enables Arbitrary Code Execution
Appears with
- BeautyStealermalware · 3
- ESETvendor · 2
- GIFTEDCROOKmalware · 1
- Ukrainian organizationsvictim · 1
- law enforcementvictim · 1
- Ukrainian government agenciesvictim · 1
- defense organizationsvictim · 1
- Prime ReverseShellmalware · 1
- WinRARproduct · 1
- city councilsvictim · 1
- defense sector entitiesvictim · 1
- WinRARvendor · 1
- Ukrainian law enforcementvictim · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.