Gorbag Hackers Exploit WinRAR Vulnerability to Steal Credentials From Ukrainian Government Agencies
Gorbag uses CVE-2025-8088 in WinRAR to deliver BeautyStealer for credential theft from Ukrainian targets since February 2025.
The item is about Gorbag Hackers Exploit WinRAR Vulnerability to Steal Credentials From Ukrainian Government Agencies
Unconfirmed: Whether stolen credentials enable further intrusions by other groups is unconfirmed.
- BeautyStealer also harvests KeePass and Java KeyStore files.
- About one quarter of targets are law enforcement or justice bodies.
- Malware versions from 0.9 to 2.0 use RC4 encryption in version 2.
- Fixed in WinRAR 7.13.
Impact: Steals browser credentials, VPN configurations and sensitive documents
- 1.Deploy WinRAR 7.13
- 2.Examine IoCs and indicators for compromise
- CVEs
- CVE-2025-8088
- Products
- WinRAR
- Threat actors
- Gorbag
- Malware
- BeautyStealer
- Organizations
- CERT-UA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-8088 | WinRAR Path Traversal (CVE-2025-8088) Enables Arbitrary Code Execution | 8.4 | 94% | KEVRansomware | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 142.111.194.73 | eShell command server; first seen March 28, 2025 IP address 142.111.194[.]73 BeautyStealer exfiltration server; first seen June 2, 202 |
| ipv4 | 89.44.9.186 | 3AF6 Повідомлення 4726-49.rar; malicious archive IP address 89.44.9[.]186 Prime ReverseShell command server; first seen March 28, 2 |
| sha1 | 0589d2079fbef814dc7bb95c4b3b555c8b933af6 | 43E7FF8 додаток податкова.xlsm; malicious spreadsheet SHA-1 0589D2079FBEF814DC7BB95C4B3B555C8B933AF6 Повідомлення 4726-49.rar; malicious archive IP address 89.4 |
| sha1 | a5e0a82bf6cc302a20d917235643b748f73fcc27 | 0F Filename unavailable; Win64/PSW.Agent.MA detection SHA-1 A5E0A82BF6CC302A20D917235643B748F73FCC27 Windows Telemetry; Prime ReverseShell SHA-1 E27E0D0A4B308F9 |
| sha1 | c17369b4b49113d07f080df832e218156fb0940f | of compromise (IoCs):- Type Indicator Source context SHA-1 C17369B4B49113D07F080DF832E218156FB0940F Filename unavailable; Win64/PSW.Agent.MA detection SHA-1 A5 |
| sha1 | e27e0d0a4b308f9b6b0469159931eb5e343e7ff8 | 643B748F73FCC27 Windows Telemetry; Prime ReverseShell SHA-1 E27E0D0A4B308F9B6B0469159931EB5E343E7FF8 додаток податкова.xlsm; malicious spreadsheet SHA-1 0589D20 |
From the original article
3 min read at cybersecuritynews.com
Russia-aligned hackers tracked as Gorbag are exploiting a WinRAR vulnerability to steal browser credentials, VPN configurations, and sensitive documents from Ukrainian organizations. Active since at least February 2025, the group targets government agencies, law enforcement bodies, justice institutions, local administrations near the front line, and defense organizations.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.