Gorbag: WinRAR CVE-2025-8088 and BeautyStealer Used to Quickly Harvest Ukrainian Government and Defense Intelligence

1. Overview

• Title: Gorbag: Orcs at the border harvesting intelligence from Ukraine
• Source: ESET Research
• Published: 2026-11-03
• Original: ESET Research
• Related Sources: The Record: Russia-linked cyber spies target Ukraine's war support, WinRAR 7.13 release notes
• Associated Malware: BeautyStealer, Prime ReverseShell
• Associated Threat Groups: Gorbag (CERT-UA attributes the related GIFTEDCROOK tool to UAC-0226; this does not establish that Gorbag and UAC-0226 are aliases.)
• Associated CVEs: CVE-2025-8088
• Related Products and Services: WinRAR, Microsoft Excel, PowerShell, Telegram API, OpenVPN
• Severity: High

2. Executive Summary

ESET Research reported activity from a threat group named "Gorbag," which has targeted Ukrainian judicial and law enforcement agencies, local government offices near the frontline, and logistics hubs for defense and military support since February 2025. The attackers deliver macro-enabled Excel files via spearphishing or, starting in early 2026, RAR archives exploiting a WinRAR vulnerability (CVE-2025-8088). These payloads deploy the BeautyStealer information stealer to harvest browser-saved credentials, OpenVPN configurations, and sensitive documents before self-deleting.

Exfiltration of credentials and documents has been confirmed across multiple government and defense organizations, demonstrating how known vulnerabilities are rapidly operationalized for initial access. ESET's assessment of "Russia-aligned" activity should be distinguished from direct command, control, or involvement by the Russian government.

3. Attack Flow

Gorbag has used different initial access vectors depending on the timeframe; WinRAR was not exploited as a direct continuation of the Excel macro vector.

Attack Vector A: 2025 Macro Execution Chain

1. A spearphishing email, which may include a compromised legitimate sender, delivers a macro-enabled Excel file to the victim.
2. When the victim enables macros or if Office security settings allow automatic macro execution, VBA decodes a Base64 payload hidden within a cell, places BeautyStealer in the %ProgramData% directory, and executes it.
3. The malware collects browser passwords, cookies, VPN settings, and target files, archives them, transmits them to a Telegram API or FastAPI-based C2 server, and then deletes itself.

Attack Vector B: 2026 WinRAR Vulnerability Exploitation Chain

1. A weaponized RAR archive is delivered, and the victim opens it using a vulnerable version of WinRAR.
2. Exploiting CVE-2025-8088, while displaying a decoy PDF file, the attack places a shortcut (LNK) in the Windows Startup folder and writes an encrypted payload and a PowerShell loader to %ProgramData%.
3. Upon the next system boot or logon, the PowerShell loader runs, launching BeautyStealer to collect information and exfiltrate it externally.

4. Attacker Positioning and Execution Location

• The attack begins with an external attacker delivering malicious attachments to a victim's mailbox. After establishing client-side execution under user privileges on the endpoint, the attacker accesses browser profiles, VPN settings, mounted shared drives, and removable media.

5. Victim and Administrator Perspectives

Victims

• After opening Excel files, RAR archives, or decoy PDFs disguised as official administrative documents, fine notices, or tax communications, information is stolen in the background without notable system anomalies.

Administrators

• Observations include Excel placing payloads in %ProgramData% under the macro vector, WinRAR creating suspicious LNK files in the Startup folder under the RAR vector, PowerShell loader execution, unknown executables in %ProgramData%, access to browser and VPN configuration files, HTTP traffic directed to the Telegram API or specific IP addresses, and traces of executable self-deletion.

6. Success and Failure Conditions

Success Conditions

• The victim opens the malicious attachment and permits macro execution for the 2025 vector, or exploitation of CVE-2025-8088 succeeds in a vulnerable WinRAR environment for the 2026 vector.
• The payload has read permissions for browser profiles, VPN settings, documents with specified extensions, and shared drives, and outbound egress traffic to the Telegram API or C2 server is allowed.

Failure Conditions and Mitigations

• Update Windows WinRAR to version 7.13 or later, which fixes CVE-2025-8088, to resolve the path traversal vulnerability, and monitor or restrict unauthorized writes to the Startup folder. Note that updating does not disable the entire Alternate Data Stream (ADS) feature.
• Completely block macro execution for Office files obtained via the internet using Group Policy or similar controls, and apply attachment sandboxing, PowerShell script block logging, and strict outbound traffic filtering.
• Avoid long-term plain-text storage of VPN private keys and critical credentials on browsers or endpoints, and enforce Multi-Factor Authentication (MFA) and regular credential rotation.

7. What Happens Upon Success

• Exfiltration of passwords, session cookies, and Local State information saved in web browsers.
• Leakage of OpenVPN configuration files (.ovpn) and authentication credentials.
• External extraction of business documents, email archives, and encryption-key-related files.
• Temporary persistence via the Startup folder, followed by self-deletion after exfiltration is complete to conceal forensic artifacts.

8. Observable Logs

Inference: The following is a list of logs to investigate within your organization. This depends on log collection and retention settings and does not imply that all log outputs were confirmed in the primary source.

• Email: Subject lines masquerading as administrative agencies, fines, or taxes; emails sent from compromised Ukrainian government domains; .xlsm or .rar attachments.
• Proxy / SWG / DNS: Suspicious HTTP/HTTPS traffic destined for Telegram's sendDocument API, FastAPI C2 servers, 89.44.9[.]186, and 142.111.194[.]73.
• Endpoint / EDR: Spawning of child processes by WinRAR or Excel, creation of LNK files in the Startup folder, execution of PowerShell loaders from %ProgramData%, BeautyStealer processes, enumeration of browser and VPN configuration files, and self-deletion commands.
• Identity / IdP: Usage of stolen cookies or VPN credentials from unknown IPs, and access from suspicious locations (impossible travel).
• SaaS / Cloud: Access to the Telegram API from within the organization, and establishment of suspicious VPN sessions.
• Network: C2 beacon communication, external upload traffic for archive files, and shared folder discovery directed at internal file servers.

9. Attack Success Determination

Data Exfiltration or Session Compromise Confirmed

• Determination Stage: Data exfiltration or session compromise confirmed (data_or_session_compromise) / Scope: Target organizations within Ukraine identified by ESET.
• Basis: ESET tracked Gorbag's targeting telemetry and multiple BeautyStealer versions, confirming capabilities to collect browser credentials, VPN configurations, and selected documents and exfiltrate them via Telegram or FastAPI-based C2 servers. The complete set of data stolen from each victim has not been publicly disclosed.

10. Investigation Playbook

Inference: The following is an incident investigation procedure for your organization.

Trigger

• Triggered by unexpected receipt of .xlsm or .rar files, LNK writes to the Startup folder by a WinRAR process, PowerShell loader execution, or alerts for high-volume data transmission to the Telegram API.

Initial Verification

• Verify email senders, attachment hashes, WinRAR versions, user open actions, newly registered startup items, suspicious files under %ProgramData%, and connection destination C2s.

Endpoint

• Preserve original emails, traces of RAR extraction, LNK files, PowerShell loaders, memory dumps, access histories for browsers and VPN configurations, and traces of self-deletion scripts.

Identity / Cloud

• Bulk revoke browser sessions, VPN sessions, and cloud email sessions associated with compromised endpoints, and rotate passwords and certificates.

Subsequent Compromise

• Track unauthorized logons using stolen cookies or VPN configurations, additional access to shared drives, and signs of lateral movement.

Containment

• Isolate affected endpoints from the network, block communication IOCs via firewall, update WinRAR, disable macros, and reissue credentials.

Assessment

• Evaluate and categorize each stage: email delivery, user opening, successful macro or vulnerability exploitation, information collection, external exfiltration, and subsequent compromise.

11. Defense and Detection Ideas

Single Event Detection

• Detect LNK writes to the Startup folder by WinRAR for the RAR vector, payload placement in %ProgramData% by Office for the macro vector, PowerShell script execution from %ProgramData%, and outbound uploads destined for the Telegram API endpoint.

Time-Series Correlation

• Perform time-series correlation analysis across the sequence of opening attachments, placing LNKs and payloads, continuous access to browser and VPN settings, archive creation, C2 transmission, and self-deletion.

Hunting Perspective

• Search for public IOCs, CVE-2025-8088 exploitation signatures, BeautyStealer hash values, suspicious LNKs in the Startup folder, and Telegram/FastAPI communication history.

Blind Spots in Log Design

• Because the malware self-deletes after transmission is complete, post-incident investigation becomes extremely difficult if process generation or file creation audit logs on the endpoint are missing.

Priority Mitigations

• Prioritize applying patches for the latest version of WinRAR (7.13 or later), completely disabling Office macros, sandbox inspection of attachments, enforcement of PowerShell execution policies, and C2 blocking via web filtering.

12. Facts / Inference / Hypothesis

Facts

• ESET has tracked Gorbag as a Russia-aligned threat actor active since at least February 2025, with all confirmed targets concentrated within Ukraine.
• Target organizations include judicial and law enforcement agencies, local municipal offices near the front lines, the defense sector, and key logistics hubs for foreign military assistance.
• The 2025 attack chain used macro-enabled Excel files, where VBA decoded Base64 data inside cells to place and execute BeautyStealer in %ProgramData%.
• Since early 2026, weaponized RAR archives have exploited WinRAR CVE-2025-8088, displaying a decoy PDF while placing an LNK in the Startup folder and an encrypted payload and PowerShell loader in %ProgramData%.
• Across its versions, BeautyStealer targets cookies, saved passwords, and Local State information from Chrome, Edge, Opera, and Firefox. It also targets OpenVPN configurations, Office documents, archives, and files associated with cryptographic keys.
• Collected data is archived and transmitted to Telegram's sendDocument API or a FastAPI C2 server introduced in version 1.2 or later.
• BeautyStealer includes a feature to delete itself after transmitting information, and ESET assesses the operation as prioritizing rapid, single-shot information gathering over long-term persistence.
• The "Prime ReverseShell" included in the malware samples contained comments intended to deceive AI assistants; however, ESET's validation showed that both AI assistants correctly identified the reverse shell functionality.

Inference

• Inference: Due to its specialization in rapid information gathering and credential theft, it has been noted that Gorbag may function as an Initial Access Broker (IAB) providing footholds and intelligence to other Russia-aligned threat actors, though specific cooperative relationships have not been confirmed.
• Inference: Target selection aligns highly with Russian wartime intelligence requirements, but this does not directly prove direct command, control, or funding by specific government agencies.

Hypothesis

No additional hypotheses. Unverified items are listed in "Unknowns and Limitations."

13. MITRE ATT&CK Mapping

14. Unknowns and Limitations

• Direct organizational relationships between Gorbag and Russian government agencies, the identities of specific operators, and operational tasking chains cannot be determined from public information.
• It remains unverified whether footholds or intelligence were provided to other threat groups as an Initial Access Broker, or whether stolen credentials were repurposed for subsequent attacks.
• The names of all victim organizations, the total number of compromised endpoints, the total exfiltrated data volume, and all C2 infrastructure for related tools are not publicly disclosed.

15. Impact on SOCs and Organizations

Organizations running affected Windows versions of WinRAR should update to version 7.13 or later to address CVE-2025-8088. Furthermore, organizations with ties to foreign governments, international logistics, or defense sectors should heighten vigilance against suspicious attachments (Excel or RAR) disguised as legitimate partners or administrative agencies, and establish mechanisms to detect and block suspicious upload traffic abusing external legitimate services such as Telegram.

16. Summary by Role

• SOC: Separate the RAR path (opening, Startup LNK placement, PowerShell launch) from the Excel macro path (payload placement), and monitor subsequent outbound traffic to Telegram/FastAPI.
• Administrators: Apply the latest WinRAR patches, enforce the blocking of automatic macro execution, prevent unauthorized writes to the Startup folder, and thoroughly protect browser credentials.
• Users: Refuse to open suspicious email attachments disguised as administrative notices or tax communications, and verify through alternative channels even if the sender appears legitimate.