Gorbag APT exploits WinRAR CVE-2025-8088 to deploy BeautyStealer
Original title: Russia-Aligned Gorbag APT Exploits WinRAR CVE-2025-8088 to Deploy BeautyStealer Infostealer
Russia-aligned Gorbag APT deploys BeautyStealer infostealer via WinRAR flaw in spearphishing emails against Ukrainian law enforcement and government targets.
Gorbag, a Russia-aligned threat actor, has used a path traversal vulnerability in WinRAR to deliver BeautyStealer since at least February 2025. The group targets Ukrainian justice institutions, law enforcement, local administrations and defense organizations. Once macros execute in lure spreadsheets, VBA routines decode and drop the infostealer which collects browser data and other files before uploading via Telegram.
Unconfirmed: Exact number of victims and full IOC list not fully enumerated in the report
- BeautyStealer supports Chrome, Edge, Firefox and Opera
- Targets include KeePass databases and Ukrainian .zs2 electronic signature files
- Campaign shifted to RAR attachments in early 2026
- Fixed in WinRAR 7.13 released July 2025
- Approximately 25% of targets are Ukrainian law enforcement
Impact: stealing browser cookies passwords and documents
- 1.upgrade to WinRAR 7.13
- 2.restrict administrative interfaces
- 3.verify firmware updates
- CVEs
- CVE-2025-8088
- Vendors
- WinRAR
- Threat actors
- Gorbag
- Malware
- BeautyStealer
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-8088 | WinRAR Path Traversal (CVE-2025-8088) Enables Arbitrary Code Execution | 8.4 | 94% | KEVRansomware | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | a5e0a82bf6cc302a20d917235643b748f73fcc27 | 2E218156FB0940F N/A Win64/PSW.Agent.MA Spearphishing email. A5E0A82BF6CC302A20D917235643B748F73FCC27 Windows Telemetry PowerShell/ReverseShell.OB Prime ReverseS |
| sha1 | c17369b4b49113d07f080df832e218156fb0940f | emain unobserved. IOCs SHA-1 Filename Detection Description C17369B4B49113D07F080DF832E218156FB0940F N/A Win64/PSW.Agent.MA Spearphishing email. A5E0A82BF6CC302 |
| sha1 | e27e0d0a4b308f9b6b0469159931eb5e343e7ff8 | ws Telemetry PowerShell/ReverseShell.OB Prime ReverseShell. E27E0D0A4B308F9B6B0469159931EB5E343E7FF8 додаток податкова.xlsm VBA/TrojanDropper.Agent.DAT XLS lure |
From the original article
3 min read at gbhackers.com
A targeted cyberespionage campaign by Gorbag, a Russia-aligned threat actor exploiting WinRAR vulnerability CVE-2025-8088 to deploy BeautyStealer against Ukrainian organizations.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.