Skip to content
NewA calmer, faster ZeroHour
StoryThreat actorhighExploited in the wild

Gorbag APT Exploits MDaemon CVE-2025-8088 to Deploy BeautyStealer in Ukraine

4 sources · 4 articlesFirst reported Updated ()
What's new

November 3: New reports identify Gorbag APT actor, add BeautyStealer self-deletion, C2 on Telegram/FastAPI, and targets including war crimes investigations and military aid routes.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Russia-aligned Gorbag APT exploits MDaemon CVE-2025-8088 via RARs to drop self-deleting BeautyStealer targeting Ukrainian defense and law enforcement entities since February 2025.

Russia-aligned Gorbag APT has exploited CVE-2025-8088 in MDaemon's outdated ClamAV library through emailed crafted RAR archives since at least February 2025. The vulnerability triggers attachment scanning without user interaction, delivering BeautyStealer that steals passwords, cookies, VPN configs and files with 40 extensions before self-deleting. Targets span Ukrainian law enforcement, city councils near front lines, defense entities, war crimes investigations and military aid infrastructure. ESET tracked the campaign in its Q2-Q3 2026 report, with no named group attribution.

Key facts
  • CVE-2025-8088 WinRAR path traversal fixed in ClamAV July 27, 2025
  • MDaemon before 26.0.4 vulnerable; fixed August 25, 2026
  • BeautyStealer self-deletes after harvesting credentials and 40 file extensions
  • C2 infrastructure uses Telegram or custom FastAPI server
  • Campaign active since February 2025 against Ukrainian targets
  • Malware includes BeautyStealer and Prime ReverseShell
Analyze CVE-2025-8088 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Jul 27, 2025ClamAV fixes CVE-2025-8088 path traversal · GBHackers
  2. Aug 25, 2025MDaemon 26.0.4 releases patched ClamAV · GBHackers
  3. Nov 3, 2026Reports detail Gorbag APT use of exploit against Ukrainian targets · Help Net Security

What each outlet adds

beyond the shared facts
  • Help Net SecurityBeautyStealer self-deletes after data theft and targets city councils near front lines
  • The Hacker NewsIdentifies Gorbag APT, adds GIFTEDCROOK malware and C2 on Telegram or FastAPI
  • The RecordTargets war crimes investigations, Russian strike damage assessments and military aid routes
  • GBHackersMDaemon-specific implementation dropping HELLAGE/HELLTAG DLLs
CVEs
CVE-2025-8088
Vendors
ESETMDaemonClamAVWinRAR
Products
WinRAR
Threat actors
Gorbag
Malware
BeautyStealerPrime ReverseShellHELLAGEHELLTAGGIFTEDCROOK
Victims
Ukrainian government agenciesdefense organizationslaw enforcementUkrainian law enforcementcity councilsdefense sector entitiesUkrainian organizations
Organizations
ESETCERT-UA
Countries
UkraineRussia

Coverage

oldest first · one row per article · UTC
  1. · 3d ago GBHackersFirst report

    Russia-aligned actors exploit MDaemon flaw to plant backdoors with no clicks

    ESET says MDaemon before 26.0.4 runs CVE-2025-8088 while scanning a malicious RAR, dropping HELLAGE or HELLTAG DLLs in Ukraine.

  2. · 5h ago Help Net Security

    Gorbag APT group targets Ukrainian organizations with self-deleting malware

    Gorbag APT uses BeautyStealer that erases itself after collecting credentials from Ukrainian law enforcement, city councils and defense entities.

  3. · 4h ago The Hacker News

    Russia-Aligned Gorbag Hackers Use WinRAR Flaw for Data-Stealing Malware

    Gorbag deploys BeautyStealer after exploiting a now-patched WinRAR flaw in attacks on Ukrainian targets.

  4. · 2h ago The Record

    Russia-linked Gorbag targets Ukraine war support

    Gorbag steals data from Ukrainian defense and law enforcement using phishing and WinRAR exploit.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2025-8088
WinRAR Path Traversal (CVE-2025-8088) Enables Arbitrary Code Execution
8.494%KEVRansomware
KEV