ESET researchers uncover Gorbag, a Russia-aligned group using simple infostealers to harvest data from Ukrainian organizations near the front line.

Gorbag hackers exploit a WinRAR flaw to steal credentials, VPN settings, and sensitive documents from Ukrainian organizations.

ESET researchers uncover Gorbag, a Russia-aligned group using simple infostealers to harvest data from Ukrainian organizations near the front line.

Russia-aligned hackers tracked as Gorbag are exploiting a WinRAR vulnerability to steal browser credentials, VPN configurations, and sensitive documents from Ukrainian organizations. Active since at least February 2025, the group targets government agencies, law enforcement bodies, justice institutions, local administrations near the front line, and defense organizations. The campaign favors quick data theft over extended remote control. Its malware collects information in a single pass, sends the results to attacker-controlled infrastructure, and then attempts to delete itself. Researchers believe the stolen credentials could support further intrusions by other groups, although that possible relationship remains unconfirmed. ESET researchers writing on WeLiveSecurity identified the group’s main malware as BeautyStealer, a C++ information stealer, alongside an earlier tool called Prime ReverseShell. Their November 3 report connects previously reported GIFTEDCROOK activity, attributed by CERT-UA to UAC-0226, with a wider intelligence-gathering operation against Ukrainian targets. Gorbag Hackers Exploit WinRAR Vulnerability Throughout 2025, Gorbag mainly used targeted phishing emails carrying malicious Excel attachments. Messages referenced routine government business, including administrative fines and taxes. At least one message came from a compromised Ukrainian local government mailbox, giving recipients another reason to trust the attachment. These attacks resemble the previously documented GIFTEDCROOK browser credential theft campaign, which also used spreadsheets containing hidden payloads. When macros ran, a VBA routine decoded malicious content stored inside spreadsheet cells, saved the payload on disk, and launched BeautyStealer. The process depended on victims enabling macros or having settings that permitted execution. Spearphishing email message from a compromised email sender (Source – Welivesecurity) In early 2026, Gorbag switched to malicious RAR archives exploiting CVE-2025-8088. This WinRAR path traversal vulnerability lets specially crafted archive content escape the folder selected for extraction. Attackers abuse alternate data streams, a Windows file feature, to place malicious files elsewhere on the system. The flaw had already featured in RomCom WinRAR phishing attacks before Gorbag adopted it. In Gorbag’s chain, archive extraction presents a decoy PDF while planting a shortcut in the Windows Startup folder. An encrypted payload and PowerShell loader are also written to disk, with the shortcut triggering the loader during subsequent system startups. About one quarter of identified targets were justice or law enforcement organizations. Another quarter were local government bodies, mostly city councils near the front line. Researchers suggest these targets could provide information about war crimes investigations, infrastructure damage, and local defense initiatives. These explanations remain assessments rather than confirmed objectives. BeautyStealer Harvests Browser Data, Documents, and Private Keys BeautyStealer collects saved passwords, cookies, and browser state from Chrome, Edge, Opera, and Firefox. It also searches for OpenVPN configurations and selected files across Desktop, Documents, and Downloads folders, removable media, and mapped network drives. Its reach therefore extends beyond browser credentials to potentially sensitive organizational records. The broader pattern matches earlier reporting on Russian WinRAR credential theft targeting Ukrainian organizations. ESET found that BeautyStealer also seeks KeePass databases, Java KeyStore files, Remote Desktop configurations, and certificate containers. Prime ReverseShell with a comment trying to fool AI (Source – Welivesecurity) Particularly notable are Ukrainian electronic signature key files, which contain secret keys issued by accredited certification centers. Collected information is compressed before being sent through Telegram’s sendDocument API or, from version 1.2 onward, to a custom server using FastAPI. Version 2.0 introduced RC4 encryption and replaced earlier batch-script cleanup with direct Windows API calls for self-deletion. ESET tracked versions from 0.9 through 2.0. The findings reinforce the need for WinRAR security patch deployment across affected Windows systems. The vulnerability was fixed in version 7.13. Updating vulnerable installations removes this entry point, but organizations investigating suspected compromise should also examine the published indicators and consider whether credentials or sensitive files were already exposed. Indicators of compromise (IoCs):- Type Indicator Source context SHA-1 C17369B4B49113D07F080DF832E218156FB0940F Filename unavailable; Win64/PSW.Agent.MA detection SHA-1 A5E0A82BF6CC302A20D917235643B748F73FCC27 Windows Telemetry; Prime ReverseShell SHA-1 E27E0D0A4B308F9B6B0469159931EB5E343E7FF8 додаток податкова.xlsm; malicious spreadsheet SHA-1 0589D2079FBEF814DC7BB95C4B3B555C8B933AF6 Повідомлення 4726-49.rar; malicious archive IP address 89.44.9[.]186 Prime ReverseShell command server; first seen March 28, 2025 IP address 142.111.194[.]73 BeautyStealer exfiltration server; first seen June 2, 2026 Note:   IP addresses and domains are intentionally Qdefanged (e.g.,  [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM . Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs . The post Gorbag Hackers Exploit WinRAR Vulnerability to Steal Credentials From Ukrainian Government Agencies appeared first on Cyber Security News .

The Gorbag APT group steals browser logins, VPN configs and documents from Ukrainian courts and city councils, then deletes its malware.

A Russia-aligned threat actor known as Gorbag has been observed using simple information stealer malware in attacks targeting Ukrainian organizations. "Active since at least February 2025, the group has focused exclusively on Ukrainian targets, with a clear preference for law…

Russia-aligned Gorbag has hit Ukrainian justice, local government and defense bodies since 2025

Gorbag lleva desde 2025 robando credenciales, claves VPN y documentos en Ucrania con BeautyStealer y un fallo de WinRAR, destapado por ESET.

Russia-aligned Gorbag uses spear-phishing, info-stealers, and a reverse shell to collect sensitive data from Ukrainian organizations.

The Gorbag APT group steals browser logins, VPN configs and documents from Ukrainian courts and city councils, then deletes its malware.

Haz clic para acceder al contenido completo.

ESET reports Russia-aligned Gorbag has targeted Ukrainian organizations since at least February 2025 using infostealers and reverse shells. Trend Micro…

## 1. Overview * Title: Gorbag: Orcs at the border harvesting intelligence from Ukraine * Source: ESET Research * Published: 2026-11-03 * Original: ESET Research * Related Sources: The Record: Russia-linked cyber spies target Ukraine's war support, WinRAR 7.13 release notes * Associated Malware: BeautyStealer, Prime ReverseShell * Associated Threat Groups: Gorbag (CERT-UA attributes the related GIFTEDCROOK tool to UAC-0226; this does not establish that Gorbag and UAC-0226 are aliases.) * Associated CVEs: CVE-2025-8088 * Related Products and Services: WinRAR, Microsoft Excel, PowerShell, Telegram API, OpenVPN * Severity: High ## 2. Executive Summary ESET Research reported activity from a threat group named "Gorbag," which has targeted Ukrainian judicial and law enforcement agencies, local government offices near the frontline, and logistics hubs for defense and military support since February 2025. The attackers deliver macro-enabled Excel files via spearphishing or, starting in early 2026, RAR archives exploiting a WinRAR vulnerability (CVE-2025-8088). These payloads deploy the BeautyStealer information stealer to harvest browser-saved credentials, OpenVPN configurations, and sensitive documents before self-deleting. Exfiltration of credentials and documents has been confirmed across multiple government and defense organizations, demonstrating how known vulnerabilities are rapidly operationalized for initial access. ESET's assessment of "Russia-aligned" activity should be distinguished from direct command, control, or involvement by the Russian government. ## 3. Attack Flow Gorbag has used different initial access vectors depending on the timeframe; WinRAR was not exploited as a direct continuation of the Excel macro vector. Item | Attack Vector A (2025): Macro-Enabled Excel | Attack Vector B (2026): Exploiting WinRAR via RAR Archives ---|---|--- Primary Timing | Observed in 2025 | Early 2026 and later Initial Delivery Method | Spearphishing emails from compromised legitimate accounts, etc. | Spearphishing emails disguising official documents or notices Attachment Format | Macro-enabled Excel worksheet (`.xlsm`) | Weaponized RAR archive (`.rar`) Exploitation Technique / Vulnerability | Malicious VBA macro (Base64 decoding within cells) | WinRAR path traversal / file placement vulnerability (CVE-2025-8088) Payload Deployment Method | Macro directly places BeautyStealer into `%ProgramData%` | Places LNK in the Startup folder, loader in `%ProgramData%` Persistence and Execution Trigger | Immediate execution upon macro execution | Executed via PowerShell loader at the next logon or system boot Common Subsequent Actions | Collects browser credentials, VPN settings, and documents; exfiltrates via Telegram/FastAPI, then self-deletes | Collects browser credentials, VPN settings, and documents; exfiltrates via Telegram/FastAPI, then self-deletes ### Attack Vector A: 2025 Macro Execution Chain 1. A spearphishing email, which may include a compromised legitimate sender, delivers a macro-enabled Excel file to the victim. 2. When the victim enables macros or if Office security settings allow automatic macro execution, VBA decodes a Base64 payload hidden within a cell, places BeautyStealer in the `%ProgramData%` directory, and executes it. 3. The malware collects browser passwords, cookies, VPN settings, and target files, archives them, transmits them to a Telegram API or FastAPI-based C2 server, and then deletes itself. ### Attack Vector B: 2026 WinRAR Vulnerability Exploitation Chain 1. A weaponized RAR archive is delivered, and the victim opens it using a vulnerable version of WinRAR. 2. Exploiting CVE-2025-8088, while displaying a decoy PDF file, the attack places a shortcut (LNK) in the Windows Startup folder and writes an encrypted payload and a PowerShell loader to `%ProgramData%`. 3. Upon the next system boot or logon, the PowerShell loader runs, launching BeautyStealer to collect information and exfiltrate it externally. ## 4. Attacker Positioning and Execution Location * The attack begins with an external attacker delivering malicious attachments to a victim's mailbox. After establishing client-side execution under user privileges on the endpoint, the attacker accesses browser profiles, VPN settings, mounted shared drives, and removable media. ## 5. Victim and Administrator Perspectives ### Victims * After opening Excel files, RAR archives, or decoy PDFs disguised as official administrative documents, fine notices, or tax communications, information is stolen in the background without notable system anomalies. ### Administrators * Observations include Excel placing payloads in `%ProgramData%` under the macro vector, WinRAR creating suspicious LNK files in the Startup folder under the RAR vector, PowerShell loader execution, unknown executables in `%ProgramData%`, access to browser and VPN configuration files, HTTP traffic directed to the Telegram API or specific IP addresses, and traces of executable self-deletion. ## 6. Success and Failure Conditions ### Success Conditions * The victim opens the malicious attachment and permits macro execution for the 2025 vector, or exploitation of CVE-2025-8088 succeeds in a vulnerable WinRAR environment for the 2026 vector. * The payload has read permissions for browser profiles, VPN settings, documents with specified extensions, and shared drives, and outbound egress traffic to the Telegram API or C2 server is allowed. ### Failure Conditions and Mitigations * Update Windows WinRAR to version 7.13 or later, which fixes CVE-2025-8088, to resolve the path traversal vulnerability, and monitor or restrict unauthorized writes to the Startup folder. Note that updating does not disable the entire Alternate Data Stream (ADS) feature. * Completely block macro execution for Office files obtained via the internet using Group Policy or similar controls, and apply attachment sandboxing, PowerShell script block logging, and strict outbound traffic filtering. * Avoid long-term plain-text storage of VPN private keys and critical credentials on browsers or endpoints, and enforce Multi-Factor Authentication (MFA) and regular credential rotation. ## 7. What Happens Upon Success * Exfiltration of passwords, session cookies, and Local State information saved in web browsers. * Leakage of OpenVPN configuration files (`.ovpn`) and authentication credentials. * External extraction of business documents, email archives, and encryption-key-related files. * Temporary persistence via the Startup folder, followed by self-deletion after exfiltration is complete to conceal forensic artifacts. ## 8. Observable Logs Inference: The following is a list of logs to investigate within your organization. This depends on log collection and retention settings and does not imply that all log outputs were confirmed in the primary source. * **Email** : Subject lines masquerading as administrative agencies, fines, or taxes; emails sent from compromised Ukrainian government domains; `.xlsm` or `.rar` attachments. * **Proxy / SWG / DNS** : Suspicious HTTP/HTTPS traffic destined for Telegram's `sendDocument` API, FastAPI C2 servers, `89.44.9[.]186`, and `142.111.194[.]73`. * **Endpoint / EDR** : Spawning of child processes by WinRAR or Excel, creation of LNK files in the Startup folder, execution of PowerShell loaders from `%ProgramData%`, BeautyStealer processes, enumeration of browser and VPN configuration files, and self-deletion commands. * **Identity / IdP** : Usage of stolen cookies or VPN credentials from unknown IPs, and access from suspicious locations (impossible travel). * **SaaS / Cloud** : Access to the Telegram API from within the organization, and establishment of suspicious VPN sessions. * **Network** : C2 beacon communication, external upload traffic for archive files, and shared folder discovery directed at internal file servers. ## 9. Attack Success Determination ### Data Exfiltration or Session Compromise Confirmed * **Determination Stage** : Data exfiltration or session compromise confirmed (`data_or_session_compromise`) / Scope: Target organizations within Ukraine identified by ESET. * **Basis** : ESET tracked Gorbag's targeting telemetry and multiple BeautyStealer versions, confirming capabilities to collect browser credentials, VPN configurations, and selected documents and exfiltrate them via Telegram or FastAPI-based C2 servers. The complete set of data stolen from each victim has not been publicly disclosed. ## 10. Investigation Playbook Inference: The following is an incident investigation procedure for your organization. ### Trigger * Triggered by unexpected receipt of `.xlsm` or `.rar` files, LNK writes to the Startup folder by a WinRAR process, PowerShell loader execution, or alerts for high-volume data transmission to the Telegram API. ### Initial Verification * Verify email senders, attachment hashes, WinRAR versions, user open actions, newly registered startup items, suspicious files under `%ProgramData%`, and connection destination C2s. ### Endpoint * Preserve original emails, traces of RAR extraction, LNK files, PowerShell loaders, memory dumps, access histories for browsers and VPN configurations, and traces of self-deletion scripts. ### Identity / Cloud * Bulk revoke browser sessions, VPN sessions, and cloud email sessions associated with compromised endpoints, and rotate passwords and certificates. ### Subsequent Compromise * Track unauthorized logons using stolen cookies or VPN configurations, additional access to shared drives, and signs of lateral movement. ### Containment * Isolate affected endpoints from the network, block communication IOCs via firewall, update WinRAR, disable macros, and reissue credentials. ### Assessment * Evaluate and categorize each stage: email delivery, user opening, successful macro or vulnerability exploitation, information collection, external exfiltration, and subsequent compromise. ## 11. Defense and Detection Ideas ### Single Event Detection * Detect LNK writes to the Startup folder by WinRAR for the RAR vector, payload placement in `%ProgramData%` by Office for the macro vector, PowerShell script execution from `%ProgramData%`, and outbound uploads destined for the Telegram API endpoint. ### Time-Series Correlation * Perform time-series correlation analysis across the sequence of opening attachments, placing LNKs and payloads, continuous access to browser and VPN settings, archive creation, C2 transmission, and self-deletion. ### Hunting Perspective * Search for public IOCs, CVE-2025-8088 exploitation signatures, BeautyStealer hash values, suspicious LNKs in the Startup folder, and Telegram/FastAPI communication history. ### Blind Spots in Log Design * Because the malware self-deletes after transmission is complete, post-incident investigation becomes extremely difficult if process generation or file creation audit logs on the endpoint are missing. ### Priority Mitigations * Prioritize applying patches for the latest version of WinRAR (7.13 or later), completely disabling Office macros, sandbox inspection of attachments, enforcement of PowerShell execution policies, and C2 blocking via web filtering. ## 12. Facts / Inference / Hypothesis ### Facts * ESET has tracked Gorbag as a Russia-aligned threat actor active since at least February 2025, with all confirmed targets concentrated within Ukraine. * Target organizations include judicial and law enforcement agencies, local municipal offices near the front lines, the defense sector, and key logistics hubs for foreign military assistance. * The 2025 attack chain used macro-enabled Excel files, where VBA decoded Base64 data inside cells to place and execute BeautyStealer in `%ProgramData%`. * Since early 2026, weaponized RAR archives have exploited WinRAR CVE-2025-8088, displaying a decoy PDF while placing an LNK in the Startup folder and an encrypted payload and PowerShell loader in `%ProgramData%`. * Across its versions, BeautyStealer targets cookies, saved passwords, and Local State information from Chrome, Edge, Opera, and Firefox. It also targets OpenVPN configurations, Office documents, archives, and files associated with cryptographic keys. * Collected data is archived and transmitted to Telegram's `sendDocument` API or a FastAPI C2 server introduced in version 1.2 or later. * BeautyStealer includes a feature to delete itself after transmitting information, and ESET assesses the operation as prioritizing rapid, single-shot information gathering over long-term persistence. * The "Prime ReverseShell" included in the malware samples contained comments intended to deceive AI assistants; however, ESET's validation showed that both AI assistants correctly identified the reverse shell functionality. ### Inference * Inference: Due to its specialization in rapid information gathering and credential theft, it has been noted that Gorbag may function as an Initial Access Broker (IAB) providing footholds and intelligence to other Russia-aligned threat actors, though specific cooperative relationships have not been confirmed. * Inference: Target selection aligns highly with Russian wartime intelligence requirements, but this does not directly prove direct command, control, or funding by specific government agencies. ### Hypothesis No additional hypotheses. Unverified items are listed in "Unknowns and Limitations." ## 13. MITRE ATT&CK Mapping ID | Technique | Confidence | Basis ---|---|---|--- T1566.001 | Spearphishing Attachment | High | Delivery of malicious Excel or RAR archives disguised as official notices or decoy documents confirmed. T1203 | Exploitation for Client Execution | High | Exploitation of WinRAR CVE-2025-8088 via weaponized RAR files confirmed. T1547.001 | Registry Run Keys / Startup Folder | High | Shortcuts (LNK) placed in the Windows Startup folder via the RAR unpacking chain. T1555.003 | Credentials from Web Browsers | High | Collection of passwords, cookies, and Local State information from multiple browsers by BeautyStealer confirmed. T1041 | Exfiltration Over C2 Channel | High | Collected data archived and transmitted to Telegram API or FastAPI C2. T1070.004 | File Deletion | High | BeautyStealer deletes its own executable file after information exfiltration is complete. ## 14. Unknowns and Limitations * Direct organizational relationships between Gorbag and Russian government agencies, the identities of specific operators, and operational tasking chains cannot be determined from public information. * It remains unverified whether footholds or intelligence were provided to other threat groups as an Initial Access Broker, or whether stolen credentials were repurposed for subsequent attacks. * The names of all victim organizations, the total number of compromised endpoints, the total exfiltrated data volume, and all C2 infrastructure for related tools are not publicly disclosed. ## 15. Impact on SOCs and Organizations Organizations running affected Windows versions of WinRAR should update to version 7.13 or later to address CVE-2025-8088. Furthermore, organizations with ties to foreign governments, international logistics, or defense sectors should heighten vigilance against suspicious attachments (Excel or RAR) disguised as legitimate partners or administrative agencies, and establish mechanisms to detect and block suspicious upload traffic abusing external legitimate services such as Telegram. ## 16. Summary by Role * **SOC** : Separate the RAR path (opening, Startup LNK placement, PowerShell launch) from the Excel macro path (payload placement), and monitor subsequent outbound traffic to Telegram/FastAPI. * **Administrators** : Apply the latest WinRAR patches, enforce the blocking of automatic macro execution, prevent unauthorized writes to the Startup folder, and thoroughly protect browser credentials. * **Users** : Refuse to open suspicious email attachments disguised as administrative notices or tax communications, and verify through alternative channels even if the sender appears legitimate.