Gorbag shifts to WinRAR archives for quick credential theft
ESET says Gorbag shifted in early 2026 from macro-enabled Excel attachments to RAR archives exploiting WinRAR’s CVE-2025-8088 against Ukrainian organizations. ESET says Russia-aligned RomCom had already exploited the same flaw. Gorbag’s targets include justice and law-enforcement bodies, front-line local administrations, defense organizations and a military-aid transport hub.
The archive displays a decoy PDF but uses path traversal—a flaw that lets archive contents land outside the folder a user chose—to place a shortcut in Windows Startup. On reboot, the shortcut launches a loader. Gorbag’s BeautyStealer collects browser credentials, virtual private network (VPN) configurations and selected documents, then attempts to erase itself. That can remove evidence of the collection without undoing the theft.
For Ukrainian organizations, the stealer’s disappearance does not establish whether credentials or files were copied. ESET says a handoff to other actors is possible, but it has not observed later intrusion stages. If stolen credentials remain usable, access could outlast Gorbag’s collection run; the reporting does not establish that follow-on access occurred.
CVSS 8.8 HIGH: a path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. EPSS 94% (100th percentile).
Russia-linked cyber spies target Ukraine's war crimes investigations, military aid routes
The hackers use relatively simple malware to steal sensitive documents, login credentials and other information from Ukrainian organizations, particularly those near the front line and the Russian border.