Russia-aligned Gorbag targets Ukrainian organizations with infostealer
Original title: Russia-Aligned Gorbag Targets Ukraine for Intelligence
Gorbag used spearphishing and WinRAR exploits to harvest credentials and documents from Ukrainian justice, law enforcement and defense entities.
A Russia-aligned cyberespionage group named Gorbag has targeted Ukrainian justice, law enforcement, local government and defense organizations since at least February 2025. The group used a custom infostealer BeautyStealer to harvest credentials, VPN configurations and documents. In 2025 the group sent spearphishing emails themed around administrative fines and taxes carrying macro-enabled Excel files. In early 2026 it switched to RAR archives exploiting CVE-2025-8088, a WinRAR path traversal flaw. The archives placed a shortcut in the Windows Startup folder and an encrypted payload and PowerShell loader in ProgramData. BeautyStealer deleted itself after sending its haul to Telegram or a custom server. ESET assessed that the group may be cooperating with others as an initial access broker but has not observed later stages.
Unconfirmed: ESET assessed the group may be cooperating with others as an initial access broker but has not observed later stages.
- Targets focused on justice, law enforcement and local administrations near Russian border
- Spearphishing emails used macro-enabled Excel files in 2025
- WinRAR path traversal flaw (CVE-2025-8088) used in early 2026
- BeautyStealer harvested cookies, saved passwords, browser data and electronic signature keys
Impact: credential and document harvesting from Ukrainian government and defense targets
- 1.Avoid opening macro-enabled documents from suspicious sources
- 2.Do not use unpatched WinRAR versions
- CVEs
- CVE-2025-8088
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-8088 | WinRAR Path Traversal (CVE-2025-8088) Enables Arbitrary Code Execution | 8.4 | 94% | KEVRansomware | KEV |
From the original article
2 min read at infosecurity-magazine.com
Russia-aligned Gorbag has hit Ukrainian justice, local government and defense bodies since 2025
By Alessandro Mascellino · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.