Gorbag uses WinRAR flaw to steal Ukraine secrets
A Russia-aligned espionage group has targeted Ukrainian courts, prosecutors, city councils and defence bodies since at least February 2025, using a WinRAR flaw to plant a self-deleting infostealer, ESET says.
ESET calls the previously undocumented group Gorbag. Its 3 November research says the targets are concentrated in Ukrainian justice and law enforcement, government near the front line, and the defence sector, including a transport hub for foreign aid. No victim count has been published.
Phishing fines, then weaponised archives
Gorbag began with spearphishing emails about fines and taxes, some sent from compromised government mailboxes, carrying Excel files. In early 2026 it switched to weaponised RAR archives exploiting CVE-2025-8088, a WinRAR path-traversal flaw patched in version 7.13 in July 2025. RomCom, another Russia-aligned group, had used it as a zero-day before the patch.
Opening the archive shows a decoy PDF while a shortcut lands in the Startup folder and an encrypted payload with a PowerShell loader lands in ProgramData, running at each restart.
BeautyStealer takes credentials, then vanishes
The payload is BeautyStealer, a C++ infostealer ESET tracked from version 0.9 to 2.0. It takes cookies, saved passwords and browser data from Chrome, Edge, Opera and Firefox, plus OpenVPN configurations and about 50 file types from folders, removable drives and mapped shares — including KeePass password databases and Ukrainian electronic-signature keys. It also deploys Prime ReverseShell, a PowerShell reverse shell.
After sending its haul to Telegram or a custom server, BeautyStealer tries to delete itself. ESET calls Gorbag Russia-aligned but names no agency and gives no confidence level, and it has not established whether the group passes stolen access or data on to anyone else.
WinRAR users should be on version 7.13 or later; archives — or Excel files about fines and taxes — deserve suspicion even from a familiar address.
Sources: Infosecurity Magazine, Russia-aligned Gorbag targets Ukraine, 3 November 2026; Cyber Press, 5 November 2026; primary research: ESET, Gorbag, presented at Virus Bulletin, October 2026.
