Russia-Aligned Gorbag Hackers Use WinRAR Flaw for Data-Stealing Malware
Original title: Russia-Aligned Gorbag Hackers Exploit WinRAR Flaw to Deploy Data-Stealing Malware
Gorbag deploys BeautyStealer after exploiting a now-patched WinRAR flaw in attacks on Ukrainian targets.
A Russia-aligned threat group known as Gorbag has used a patched WinRAR vulnerability (CVE-2025-8088) to deliver GIFTEDCROOK and BeautyStealer malware targeting Ukrainian law enforcement, justice entities, local administrations and defense sectors. The stealer harvests browser data, VPN configurations and Office documents. Attacks employ spear-phishing with government-themed lures and macro-enabled Excel files.
Unconfirmed: Exact CVE used in June attacks is CVE-2025-8088
- Target preference is Ukrainian organizations near the front line
- Malware includes BeautyStealer and Prime ReverseShell
- C2 uses Telegram or custom FastAPI server
Impact: data theft from browsers and VPN configs
- CVEs
- CVE-2025-8088
- Vendors
- WinRAR
- Threat actors
- Gorbag
- Malware
- BeautyStealerGIFTEDCROOK
- Victims
- Ukrainian organizations
- Countries
- Russia
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-8088 | WinRAR Path Traversal (CVE-2025-8088) Enables Arbitrary Code Execution | 8.4 | 94% | KEVRansomware | KEV |
From the original article
3 min read at thehackernews.com
A Russia-aligned threat actor known as Gorbag has been observed using simple information stealer malware in attacks targeting Ukrainian organizations. "Active since at least February 2025, the group has focused exclusively on Ukrainian targets, with a clear preference for law enforcement and justice entities, local administrations near the front line, and the defense sector," ESET researcher
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.