Russia-linked Gorbag targets Ukraine war support
Original title: Russia-linked cyber spies target Ukraine's war crimes investigations, military aid routes
Gorbag steals data from Ukrainian defense and law enforcement using phishing and WinRAR exploit.
A previously unidentified Russia-aligned hacking group dubbed Gorbag has been targeting Ukrainian government agencies, defense organizations and infrastructure for foreign military aid since at least February 2025. The group uses phishing emails with malicious attachments and malware like BeautyStealer to steal documents, credentials and files. They also exploit a WinRAR vulnerability to execute code. Targets include war crimes investigations, Russian strike damage assessments and local defense preparations.
- Active since February 2025
- Uses phishing emails with malicious attachments
- Steals passwords, cookies and Office documents
- Exploits WinRAR CVE-2025-8088
- Targets Ukrainian law enforcement and border areas
Impact: stealing sensitive documents and login credentials
- CVEs
- CVE-2025-8088
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-8088 | WinRAR Path Traversal (CVE-2025-8088) Enables Arbitrary Code Execution | 8.4 | 94% | KEVRansomware | KEV |
From the original article
3 min read at therecord.mediaThe hackers use relatively simple malware to steal sensitive documents, login credentials and other information from Ukrainian organizations, particularly those near the front line and the Russian border.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.