Gorbag (UAC-0226) Targets Ukrainian Law Enforcement and Defense Sectors with GIFTEDCROOK and BeautyStealer Infostealers
ESET researcher Damien Schaeffer details a Russia-aligned threat cluster dubbed Gorbag, overlapping with CERT-UA's UAC-0226 and Trend Micro's SHADOW-EARTH-066, active since at least February 2025 against Ukrainian law enforcement, justice entities, front-line local administrations, and the defense sector. The group relies on simple infostealer malware rather than sophisticated tooling, using spear-phishing emails with government-themed lures (fines, taxes) to deliver macro-enabled Excel attachments that execute BeautyStealer. Earlier in 2025, Trend Micro linked the group to exploitation of CVE-2025-8088 in WinRAR to trigger DLL sideloading and deploy GIFTEDCROOK. ESET assesses Gorbag may act as an initial access broker, harvesting VPN configurations and sensitive documents for hand-off to other actors for deeper post-exploitation.
Entenda a falha
A vulnerabilidade
CVE-2025-8088 is a vulnerability in WinRAR that the articles describe only as now patched. The sources do not give the flaw type, the affected or fixed versions, or the exact requirements. Trend Micro attributed to the Gorbag cluster (CERT-UA's UAC-0226, Trend Micro's SHADOW-EARTH-066) attacks that abused it to trigger a DLL sideloading chain, which executed the GIFTEDCROOK stealer on the victim's machine. The story presents the flaw as one step in a wider phishing-driven campaign against Ukrainian targets.
Como funciona
The articles do not explain the internal mechanism of CVE-2025-8088. They say only that exploiting the WinRAR flaw set off a DLL sideloading chain, in which a malicious library is loaded by a legitimate program, and that this chain ended in the execution of GIFTEDCROOK. How the crafted file reaches WinRAR and which step fails inside it is not described in the sources.
Por que é vulnerável
The articles do not state the root cause of CVE-2025-8088, why it went unnoticed, or what the fix changes. The only thing they say is that the flaw is now patched.
Como foi descoberta
The articles do not say who found the flaw or how it was reported. They say Trend Micro attributed to the Gorbag actor attacks that exploited CVE-2025-8088, so exploitation was seen in the wild. The Hacker News dates this to June, while the Tifon story says earlier in 2025, so the date is unclear. ESET researcher Damien Schaeffer then published a report on the group's tooling, shared with The Hacker News.
Explicação gerada por IA a partir da matéria e dos artigos, em 03/11/2026 10:16.
Detalhes técnicos
- GIFTEDCROOK: C/C++ stealer targeting browser data (cookies, history, credentials) from Chrome, Edge, and Firefox; delivered via DLL sideloading exploiting CVE-2025-8088 in WinRAR.
- BeautyStealer: primary data-harvesting tool capturing credentials from Chrome, Edge, Opera, Firefox, OpenVPN configs, Office documents, archives, emails, KeePass databases, and RDP/VPN configuration files; self-deletes after exfiltration to minimize persistence.
- Delivery: spear-phishing with macro-enabled .XLSM attachments running VBA payloads that decode and execute BeautyStealer.
- Exfiltration: stolen data compressed and sent to an attacker-controlled Telegram chat or a custom FastAPI-based C2 server.
- Prime ReverseShell: a PSSW100AVB derivative used in early 2025 waves, flagged by CERT-UA in April 2025; one variant contains a prompt-injection comment attempting to deceive AI-based malware analysis tools, though ESET found it ineffective against tested AI assistants.
Remediação
- Patch WinRAR against CVE-2025-8088 and monitor for DLL sideloading behavior.
- Block or inspect macro-enabled Office attachments from untrusted senders, especially government-themed lures.
- Monitor for Telegram API traffic and unusual FastAPI C2 communications from endpoints.
- Hunt for reverse shell scripts disguised as benign utilities (e.g., prime number generators) and do not rely solely on AI-based static analysis.
- Organizations in Ukraine's law enforcement, justice, defense, and local administration sectors should treat phishing emails with administrative/tax themes as high-risk.
Linha do tempo
-
Gorbag (UAC-0226) Targets Ukrainian Law Enforcement and Defense Sectors with GIFTEDCROOK and BeautyStealer Infostealers
ler a análise desta fonte ocultar
ESET researcher Damien Schaeffer details a Russia-aligned threat cluster dubbed Gorbag, overlapping with CERT-UA's UAC-0226 and Trend Micro's SHADOW-EARTH-066, active since at least February 2025 against Ukrainian law enforcement, justice entities, front-line local administrations, and the defense sector. The group relies on simple infostealer malware rather than sophisticated tooling, using spear-phishing emails with government-themed lures (fines, taxes) to deliver macro-enabled Excel attachments that execute BeautyStealer. Earlier in 2025, Trend Micro linked the group to exploitation of CVE-2025-8088 in WinRAR to trigger DLL sideloading and deploy GIFTEDCROOK. ESET assesses Gorbag may act as an initial access broker, harvesting VPN configurations and sensitive documents for hand-off to other actors for deeper post-exploitation.
Technical Details
- GIFTEDCROOK: C/C++ stealer targeting browser data (cookies, history, credentials) from Chrome, Edge, and Firefox; delivered via DLL sideloading exploiting CVE-2025-8088 in WinRAR.
- BeautyStealer: primary data-harvesting tool capturing credentials from Chrome, Edge, Opera, Firefox, OpenVPN configs, Office documents, archives, emails, KeePass databases, and RDP/VPN configuration files; self-deletes after exfiltration to minimize persistence.
- Delivery: spear-phishing with macro-enabled .XLSM attachments running VBA payloads that decode and execute BeautyStealer.
- Exfiltration: stolen data compressed and sent to an attacker-controlled Telegram chat or a custom FastAPI-based C2 server.
- Prime ReverseShell: a PSSW100AVB derivative used in early 2025 waves, flagged by CERT-UA in April 2025; one variant contains a prompt-injection comment attempting to deceive AI-based malware analysis tools, though ESET found it ineffective against tested AI assistants.
Remediation
- Patch WinRAR against CVE-2025-8088 and monitor for DLL sideloading behavior.
- Block or inspect macro-enabled Office attachments from untrusted senders, especially government-themed lures.
- Monitor for Telegram API traffic and unusual FastAPI C2 communications from endpoints.
- Hunt for reverse shell scripts disguised as benign utilities (e.g., prime number generators) and do not rely solely on AI-based static analysis.
- Organizations in Ukraine's law enforcement, justice, defense, and local administration sectors should treat phishing emails with administrative/tax themes as high-risk.