Russia-aligned Gorbag APT targets Ukrainian courts and city councils with BeautyStealer self-deleting stealer
ESET is tracking a Russia-aligned group, Gorbag, that has breached Ukrainian organizations since at least February 2025 using spearphishing attachments and a stealer that deletes itself after exfiltration. All identified targets are in Ukraine: about a quarter are law enforcement and justice bodies, a quarter are local administrations (mostly city councils near the front line), and the rest are defense entities plus a transportation hub for foreign military aid. ESET researcher Damien Schaeffer suggests Gorbag may act as an initial access broker sharing collected credentials with other threat actors for follow-on activity. Separately, the article notes that nearly every targeted city has come under Russian air strikes during the campaign window, which raises the possibility that the operators are giving Russian military leadership a read on how well those strikes landed.
Entenda a falha
A vulnerabilidade
CVE-2025-8088 is a path traversal flaw in WinRAR. Data hidden in alternate data streams of a RAR archive can land outside the folder the user chose for extraction. The attacker needs the victim to open a crafted RAR, typically sent by spearphishing, so user interaction is required. The result is that arbitrary files can be written to chosen locations, such as the Windows Startup folder, which gives persistence and code execution at the next restart. The articles do not state the affected or fixed WinRAR versions, only that patching WinRAR is the implied priority.
Como funciona
The victim receives a RAR archive by email and opens it with WinRAR. The archive displays a decoy PDF, while the extraction routine also processes the alternate data streams embedded in it. Because the destination path of those streams is not kept inside the selected folder, they are written elsewhere. In the Gorbag campaign, a LNK file lands in the Startup folder, and an encrypted payload and a PowerShell loader land in %ProgramData%. At each restart the LNK runs the loader, which launches the payload.
Por que é vulnerável
The articles describe it as a path traversal: WinRAR does not properly confine the extraction target of data held in alternate data streams to the folder the user picked. They give no deeper root-cause detail, no explanation of why it went unnoticed, and no description of what the fix changes.
Como foi descoberta
The flaw was not found by ESET. ESET researcher Damien Schaeffer discovered and investigated the Russia-aligned Gorbag group, which began using RAR archives exploiting CVE-2025-8088 in early 2026, so the flaw was seen exploited in the wild against Ukrainian organizations. The articles say nothing about who originally found or reported the flaw, or about the disclosure timeline.
Explicação gerada por IA a partir da matéria e dos artigos, em 03/11/2026 08:24.
Detalhes técnicos
- Through 2025, lures were macro-enabled Excel files (administrative fines, tax notices) whose VBA decodes a base64 payload from cells, drops it in %ProgramData% and runs it. One email came from a compromised account of the Uzhhorod local government.
- In early 2026 Gorbag moved to RAR archives exploiting CVE-2025-8088 (WinRAR path traversal via alternate data streams). The archive shows a decoy PDF while writing a LNK into the Startup folder, plus an encrypted payload and PowerShell loader in %ProgramData%; the LNK provides persistence.
- BeautyStealer (C++, versions 0.9 to 2.0) collects cookies, passwords and local state from Chrome, Edge, Opera and Firefox, OpenVPN configurations, and files with about 40 extensions (.kdbx, .jks, .rdp, .pfx, .zs2) from Desktop, Documents, Downloads, removable media and mapped drives, then attempts to remove itself.
- Earlier, the group used Prime ReverseShell, a PowerShell reverse shell in a .NET binary from a public GitHub repository. One variant has a comment telling LLMs it is benign; ESET found two AI assistants still identified it as a reverse shell.
Remediação
The article gives no explicit remediation. Implied priorities: patch WinRAR against CVE-2025-8088, and block or restrict macro-enabled Office documents.
Linha do tempo
-
Russia-aligned Gorbag APT targets Ukrainian courts and city councils with BeautyStealer self-deleting stealer
ler a análise desta fonte ocultar
ESET is tracking a Russia-aligned group, Gorbag, that has breached Ukrainian organizations since at least February 2025 using spearphishing attachments and a stealer that deletes itself after exfiltration. All identified targets are in Ukraine: about a quarter are law enforcement and justice bodies, a quarter are local administrations (mostly city councils near the front line), and the rest are defense entities plus a transportation hub for foreign military aid. ESET researcher Damien Schaeffer suggests Gorbag may act as an initial access broker sharing collected credentials with other threat actors for follow-on activity. Separately, the article notes that nearly every targeted city has come under Russian air strikes during the campaign window, which raises the possibility that the operators are giving Russian military leadership a read on how well those strikes landed.
Technical Details
- Through 2025, lures were macro-enabled Excel files (administrative fines, tax notices) whose VBA decodes a base64 payload from cells, drops it in %ProgramData% and runs it. One email came from a compromised account of the Uzhhorod local government.
- In early 2026 Gorbag moved to RAR archives exploiting CVE-2025-8088 (WinRAR path traversal via alternate data streams). The archive shows a decoy PDF while writing a LNK into the Startup folder, plus an encrypted payload and PowerShell loader in %ProgramData%; the LNK provides persistence.
- BeautyStealer (C++, versions 0.9 to 2.0) collects cookies, passwords and local state from Chrome, Edge, Opera and Firefox, OpenVPN configurations, and files with about 40 extensions (.kdbx, .jks, .rdp, .pfx, .zs2) from Desktop, Documents, Downloads, removable media and mapped drives, then attempts to remove itself.
- Earlier, the group used Prime ReverseShell, a PowerShell reverse shell in a .NET binary from a public GitHub repository. One variant has a comment telling LLMs it is benign; ESET found two AI assistants still identified it as a reverse shell.
Remediation
The article gives no explicit remediation. Implied priorities: patch WinRAR against CVE-2025-8088, and block or restrict macro-enabled Office documents.