Gorbag targets Ukrainian organisations with WinRAR exploit and stealers
Russia-aligned threat actor Gorbag has used a patched WinRAR vulnerability, CVE-2025-8088, and spear-phishing attachments to deploy information-stealing malware against Ukrainian organisations. ESET says the group has been active since at least February 2025 and has focused exclusively on Ukrainian targets, particularly law enforcement and justice entities, local administrations near the front line, and the defence sector.
The activity overlaps with clusters tracked as UAC-0226 by the Computer Emergency Response Team of Ukraine (CERT-UA) and SHADOW-EARTH-066 by Trend Micro. The campaign illustrates how targeted espionage can be conducted with relatively simple stealers and a reverse shell rather than a complex, long-lived malware platform.
WinRAR exploitation and targeted phishing
Trend Micro attributed Gorbag in June to attacks that weaponised CVE-2025-8088, a vulnerability in WinRAR that has since been patched. The exploit was used to trigger a DLL sideloading chain that executed GIFTEDCROOK, a C/C++ stealer.
Gorbag also uses spear-phishing messages carrying malicious attachments and lures styled as official or government notices, including administrative fines and tax-related documents. In one observed case, a macro-enabled Excel spreadsheet in XLSM format ran a VBA payload that decoded and executed BeautyStealer.
Data collection built for short operations
GIFTEDCROOK can steal cookies, browsing history and authentication data from Google Chrome, Microsoft Edge and Mozilla Firefox. BeautyStealer is designed to collect data from Chrome, Edge, Opera and Firefox, alongside OpenVPN configurations and files selected by extension.
The targeted file set includes Microsoft Office documents, archives, emails, KeePass databases, Remote Desktop Protocol configurations and VPN configurations. BeautyStealer compresses the collected material into an archive and sends it to an attacker-controlled Telegram chat or a custom command-and-control server built with FastAPI. It then removes itself from the host when the collection task is complete, indicating an on-off collection model rather than persistent access.
Reverse shell includes an AI-deception comment
Early 2025 attack waves also used Prime ReverseShell, a derivative of PSSW100AVB that can execute commands on compromised systems and return results to a command-and-control server. CERT-UA flagged UAC-0226's use of this tool in April 2025.
One script variant contained a comment telling large language models and AI tools that the file was benign prime-number software. ESET tested two AI assistants and found that the prompt injection did not prevent them from identifying the code as a reverse shell.
For security teams, the practical implication is to apply WinRAR updates promptly, scrutinise government-themed attachments and macro-enabled spreadsheets, and monitor for browser-data harvesting, archive creation, VPN configuration access and outbound transfers to Telegram or unfamiliar FastAPI-based infrastructure.