A Russia-linked hacking group known as Gorbag has weaponized a vulnerability in WinRAR to steal browser credentials, VPN configurations, and sensitive documents from multiple Ukrainian government institutions. Active since February 2025, the group has focused on agencies tied to justice, law enforcement, and regional administrations near conflict zones.
How Gorbag Carries Out Its Attacks
Initially, Gorbag relied on spear-phishing campaigns featuring Excel attachments linked to common governmental matters like taxes and fines. In some cases, they used compromised local government email accounts to make the lure more convincing. When victims enabled macros, malicious VBA code extracted payloads hidden in spreadsheet cells, installed malware such as BeautyStealer, and launched it.
By early 2026, the group shifted tactics, leveraging WinRAR’s CVE-2025-8088 vulnerability, which permits path traversal attacks. This flaw lets attackers embed files in places outside the intended extraction folder. Using alternate data streams—a feature of Windows—they deposit hostile files elsewhere on the system. The RAR archive shows a harmless PDF decoy while planting a startup folder shortcut, an encrypted payload, and a PowerShell-based loader to run on system reboot.
Data Harvest, Malware Tools & Indicators
BeautyStealer isn’t limited to browser credentials like saved passwords, cookies, or session data from Chrome, Edge, Firefox, and Opera. It also hunts for OpenVPN configuration files, documents from various user directories, certificate containers, key stores, KeePass databases, removable drive contents, and electronic signature key files—items especially valued within government and defense operations.
Versions of BeautyStealer tracked range from 0.9 up to 2.0. Later versions added features like RC4 encryption and replaced rudimentary batch-script cleanup with direct Windows API removal calls so the tool self-deletes. Data exfiltration takes place via Telegram’s document API or a custom FastAPI server. Analysts warn that the credentials may not only support this campaign but could also be reused by other malicious actors.
Affected Targets & Response Steps
About half of the organizations hit are justice or law enforcement bodies, the rest primarily local government units in front-line areas. These entities likely hold insights into war-crimes, infrastructure damage, or defense planning—making them high-value targets.
An official fix addressing CVE-2025-8088 is available in WinRAR version 7.13. Any agency or organization running older versions should apply the patch immediately. Also essential are forensic reviews of compromised systems to determine if key files or credentials have already been exposed. Security teams should use the published IoCs (SHA-1 hashes, IP addresses, malicious file names) to help hunt down indicators of infection.
While Gorbag’s methodology and targets underscore a trend of state-aligned cyber espionage focused on Ukraine, the use of known vulnerabilities such as CVE-2025-8088 serves as a reminder that patch management remains a frontline defense against high-stakes cyberattacks.
This development matters because it shows how threat actors are refining low-complexity, high-impact tactics—primed for quick extraction rather than long-term dwell. As Ukraine remains a focal point of geopolitical tension, attackers will likely continue targeting frontline institutions where sensitive data is exposed. What to watch: how other groups may leverage leaked credentials from this campaign, and whether WinRAR and similar tools prove to be repeat vectors in future targeted operations.
