ESET Uncovers Pro-Russian Group Gorbag Targeting Ukrainian Agencies via Phishing and WinRAR Flaw
Cybersecurity and privacy
Cybersecurity firm ESET detailed attacks by pro-Russian cyberespionage group Gorbag. Active since February 2025, the group targeted Ukrainian government, defense, and transit logistics hubs using spear-phishing, malicious macros, and WinRAR flaw CVE-2025-8088 to deploy BeautyStealer infostealer, likely operating as an initial access broker.
Cybersecurity firm ESET revealed that pro-Russian espionage actor Gorbag has been targeting Ukrainian critical entities, including government, judicial, defense, and foreign military aid transit hubs, since at least February 2025. Researchers assess the objective is likely war-related intelligence gathering. Gorbag predominantly relies on spear-phishing campaigns, occasionally leveraging compromised Ukrainian local government email accounts. In 2025, attackers used malicious Excel macros to drop the BeautyStealer infostealer. By early 2026, operations shifted to exploiting the WinRAR path traversal vulnerability CVE-2025-8088, planting malicious shortcuts in Windows startup folders via crafted RAR archives. BeautyStealer targets stored browser passwords, cookies, OpenVPN configurations, and documents before attempting self-deletion post-exfiltration. ESET notes the group prioritizes rapid data theft over persistence, suggesting it may function as an initial access broker supplying credentials to other threat actors.
Key takeaways
- ESET observed pro-Russian group Gorbag targeting Ukrainian government, judicial, defense, and aid logistics hubs since February 2025.
- The attack vector evolved from 2025 Excel macros to exploiting WinRAR vulnerability CVE-2025-8088 in early 2026 via weaponized RAR archives.
- BeautyStealer infostealer harvests browser credentials, cookies, VPN profiles, and files, attempting self-deletion after data exfiltration.
- Researchers suggest Gorbag operates as an initial access broker focusing on rapid theft rather than persistent long-term system control.
Source：iThome Read the original ↗
Prepared, checked and automatically published by AI; not individually reviewed by a human. Translation checked by AI.