Threats · 1h ago
ESET says Gorbag shifted in early 2026 to malicious RAR archives exploiting WinRAR’s CVE-2025-8088 against Ukrainian organizations. Targets include courts and law-enforcement bodies, front-line local administrations, defense organizations, and a transportation entity. Earlier lures included macro-enabled Excel files; one came from a compromised local-government email account.
The WinRAR flaw lets hidden data in an archive write files outside the folder the user chose. Gorbag’s archives displayed a decoy PDF while placing a shortcut in Windows Startup to launch a loader on reboot. ESET says the group’s stealer collects browser and VPN credentials and selected documents, then attempts to erase itself—removing malware evidence without undoing the theft.
For Ukrainian organizations, a WinRAR fix and malware removal do not establish whether credentials or files were already taken. If stolen credentials reach another actor, access may continue after Gorbag’s collection tool is gone.
Known exploited · CISA KEV
CVSS 8.8 HIGH: a path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. EPSS 94% (100th percentile).
CISA federal remediation date Sep 2 · date passed
3 sources covering this story
The Record from Recorded Future
Russia-linked cyber spies target Ukraine's war crimes investigations, military aid routes
The hackers use relatively simple malware to steal sensitive documents, login credentials and other information from Ukrainian organizations, particularly those near the front line and the Russian border.
Russia-Aligned Gorbag Hackers Exploit WinRAR Flaw to Deploy Data-Stealing Malware
Russia-aligned Gorbag uses spear-phishing, info-stealers, and a reverse shell to collect sensitive data from Ukrainian organizations.
The Gorbag APT group steals browser logins, VPN configs and documents from Ukrainian courts and city councils, then deletes its malware.
Part of the PlainSec briefing for 2026-11-03