Gorbag Hackers Exploit WinRAR Vulnerability to Steal Credentials From Ukrainian Government Agencies

Russia-aligned hackers tracked as Gorbag are exploiting a WinRAR vulnerability to steal browser credentials, VPN configurations, and sensitive documents from Ukrainian organizations.

Active since at least February 2025, the group targets government agencies, law enforcement bodies, justice institutions, local administrations near the front line, and defense organizations.

The campaign favors quick data theft over extended remote control. Its malware collects information in a single pass, sends the results to attacker-controlled infrastructure, and then attempts to delete itself.

Researchers believe the stolen credentials could support further intrusions by other groups, although that possible relationship remains unconfirmed.

ESET researchers writing on WeLiveSecurity identified the group’s main malware as BeautyStealer, a C++ information stealer, alongside an earlier tool called Prime ReverseShell.

Their November 3 report connects previously reported GIFTEDCROOK activity, attributed by CERT-UA to UAC-0226, with a wider intelligence-gathering operation against Ukrainian targets.

Gorbag Hackers Exploit WinRAR Vulnerability

Throughout 2025, Gorbag mainly used targeted phishing emails carrying malicious Excel attachments. Messages referenced routine government business, including administrative fines and taxes.

At least one message came from a compromised Ukrainian local government mailbox, giving recipients another reason to trust the attachment.

These attacks resemble the previously documented GIFTEDCROOK browser credential theft campaign, which also used spreadsheets containing hidden payloads.

When macros ran, a VBA routine decoded malicious content stored inside spreadsheet cells, saved the payload on disk, and launched BeautyStealer. The process depended on victims enabling macros or having settings that permitted execution.

In early 2026, Gorbag switched to malicious RAR archives exploiting CVE-2025-8088. This WinRAR path traversal vulnerability lets specially crafted archive content escape the folder selected for extraction.

Attackers abuse alternate data streams, a Windows file feature, to place malicious files elsewhere on the system. The flaw had already featured in RomCom WinRAR phishing attacks before Gorbag adopted it.

In Gorbag’s chain, archive extraction presents a decoy PDF while planting a shortcut in the Windows Startup folder. An encrypted payload and PowerShell loader are also written to disk, with the shortcut triggering the loader during subsequent system startups.

About one quarter of identified targets were justice or law enforcement organizations. Another quarter were local government bodies, mostly city councils near the front line.

Researchers suggest these targets could provide information about war crimes investigations, infrastructure damage, and local defense initiatives. These explanations remain assessments rather than confirmed objectives.

BeautyStealer Harvests Browser Data, Documents, and Private Keys

BeautyStealer collects saved passwords, cookies, and browser state from Chrome, Edge, Opera, and Firefox.

It also searches for OpenVPN configurations and selected files across Desktop, Documents, and Downloads folders, removable media, and mapped network drives. Its reach therefore extends beyond browser credentials to potentially sensitive organizational records.

The broader pattern matches earlier reporting on Russian WinRAR credential theft targeting Ukrainian organizations. ESET found that BeautyStealer also seeks KeePass databases, Java KeyStore files, Remote Desktop configurations, and certificate containers.

Particularly notable are Ukrainian electronic signature key files, which contain secret keys issued by accredited certification centers.

Collected information is compressed before being sent through Telegram’s sendDocument API or, from version 1.2 onward, to a custom server using FastAPI. Version 2.0 introduced RC4 encryption and replaced earlier batch-script cleanup with direct Windows API calls for self-deletion.

ESET tracked versions from 0.9 through 2.0. The findings reinforce the need for WinRAR security patch deployment across affected Windows systems. The vulnerability was fixed in version 7.13.

Updating vulnerable installations removes this entry point, but organizations investigating suspected compromise should also examine the published indicators and consider whether credentials or sensitive files were already exposed.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.