Russia-aligned Gorbag hackers exploit a WinRAR flaw to drop BeautyStealer on Ukrainian courts and city councils
A Russia-aligned group, Gorbag, used WinRAR flaw CVE-2025-8088 to deploy data-stealing malware against Ukrainian courts, councils and defense targets.
- Published
- Fixed in
- not confirmed
- Exploitation
- Yes. ESET says Gorbag used CVE-2025-8088 in RAR-archive lures to deploy BeautyStealer against Ukrainian organizations from early 2026
Live scores
CVE-2025-8088- EPSS
- 0.940
very likely to be attacked soon - VEDAS
- 0.979
strong exploit evidence - On CISA KEV
- Yes, since 2025-08-12
- Detection rule
- Out of scope (local)
Thin horizontal line: the “likely exploited” threshold (EPSS 0.10, VEDAS 0.5). Shaded “no data” areas are periods when cve-scores did not publish.
What happened
ESET disclosed a Russia-aligned group it tracks as Gorbag that has been breaking into Ukrainian organizations since at least February 2025 (Help Net Security). ESET researcher Damien Schaeffer discovered and investigated the group (Help Net Security).
The group’s activity overlaps with CERT-UA’s UAC-0226 and Trend Micro’s SHADOW-EARTH-066, and ESET suggests Gorbag may act as an initial access broker whose targeting aligns with Russia’s wartime intelligence priorities (The Hacker News).
The WinRAR flaw. Gorbag exploited CVE-2025-8088, a path traversal vulnerability in WinRAR, delivered inside RAR archive attachments (Help Net Security). The Hacker News describes CVE-2025-8088 as now-patched but names no fixed WinRAR version, and neither source states a patched version (The Hacker News). Trend Micro attributed WinRAR-based activity using this flaw to a DLL sideloading chain that executed the GIFTEDCROOK stealer (The Hacker News).
Delivery. Through 2025 the group used spearphishing with macro-enabled Excel files; from early 2026 it switched to RAR archives (Help Net Security). Lures used government themes such as fines or tax notices, and one variant used a macro-enabled .XLSM file with a VBA payload (The Hacker News). One lure was sent from a compromised Uzhhorod regional government account (Help Net Security).
The malware. BeautyStealer is the main C++ collection tool. It takes browser credentials, OpenVPN and VPN configurations, KeePass databases, RDP configs and Office documents, targeting files with extensions such as .kdbx, .jks, .rdp, .pfx and .zs2, and it removes itself after the job (Help Net Security). BeautyStealer has been seen in versions ranging from 0.9 to 2.0 and targets about 40 file extensions (Help Net Security). Before BeautyStealer the group used Prime ReverseShell, a PowerShell reverse shell wrapped in a .NET binary and taken from a public GitHub repository; it is a derivative of PSSW100AVB and was flagged by CERT-UA in April 2025 (Help Net Security, The Hacker News). Collected data is compressed and sent to a Telegram chat or a FastAPI-based command-and-control server (The Hacker News).
The targets. All identified targets are in Ukraine (Help Net Security). About a quarter are law enforcement and justice bodies (the “courts” of this campaign), about a quarter are local administrations, mostly city councils near the front line, and the rest are defense sector entities plus one major transportation hub for foreign military aid (Help Net Security). ESET says the group prefers law enforcement and justice entities, local administrations near the front line, and the defense sector (The Hacker News).
Am I affected?
You are in scope if you run WinRAR and it may have opened an untrusted RAR archive, since CVE-2025-8088 is a path traversal flaw exploited through malicious archives (Help Net Security).
You are at elevated risk if you are a Ukrainian law enforcement, justice, local government or defense organization, as every identified Gorbag target falls in these sectors (Help Net Security).
Hunt for signs of the group’s tooling:
- BeautyStealer behavior: collection of browser credentials, OpenVPN and VPN configs, KeePass databases (.kdbx), RDP configs (.rdp) and other sensitive files (.jks, .pfx, .zs2), followed by self-deletion (Help Net Security).
- Prime ReverseShell, a PowerShell reverse shell wrapped in a .NET binary (Help Net Security).
- Exfiltration to a Telegram chat or a FastAPI-based C2 server (The Hacker News).
- Government-themed spearphishing with RAR attachments, or macro-enabled Excel (.XLSM) files with VBA payloads (The Hacker News).
What to do now
- Update WinRAR on every endpoint to the latest version to remove CVE-2025-8088; neither source names a specific fixed version, so install the newest release available (The Hacker News).
- Treat archives from untrusted or unexpected senders as hostile, since the flaw is triggered by opening a malicious RAR archive (Help Net Security).
- Rotate credentials and secrets that BeautyStealer harvests if compromise is suspected: browser-stored passwords, OpenVPN and VPN configs, KeePass databases, RDP configs and certificate files (Help Net Security).
- Block and monitor for exfiltration to Telegram and unexpected FastAPI-based C2 endpoints (The Hacker News).
- Harden against the delivery method: disable Office macros by policy and scrutinize government-themed lures such as fines or tax notices, including messages from otherwise trusted government accounts (Help Net Security, The Hacker News).
Sources
- The Hacker News, Russia-aligned Gorbag hackers exploit WinRAR flaw to deploy data-stealing malware, 3 November 2026
- Help Net Security, Gorbag APT group targets Ukraine with BeautyStealer malware, 3 November 2026