Gorbag Uses WinRAR Flaw CVE-2025-8088 to Plant BeautyStealer at Ukrainian Courts, Front-Line City Councils and a Military Aid Transport Hub

High · 2026-11-06 · By H.A

Gorbag Uses WinRAR Flaw CVE-2025-8088 to Plant BeautyStealer at Ukrainian Courts, Front-Line City Councils and a Military Aid Transport Hub

A Russia-aligned espionage group called Gorbag sends RAR archives that exploit CVE-2025-8088, some from compromised Ukrainian government mailboxes, to install BeautyStealer, which steals browser credentials, VPN profiles, KeePass databases and e-signature keys, then deletes itself.

Overview

Security researchers have documented Gorbag, a Russia-aligned espionage group that attacks only Ukrainian organizations, mostly near the front line. Since early 2026 the group has used weaponized RAR archives that exploit CVE-2025-8088, a WinRAR path-traversal flaw patched in July 2025. With them it installs BeautyStealer, a C++ infostealer that collects browser credentials, VPN profiles, password databases and Ukrainian e-signature keys in one pass, then deletes itself.

The researchers' attribution draws on overlap with UAC-0226, the cluster CERT-UA links to the GIFTEDCROOK infostealer, and on targeting that matches Russian wartime intelligence priorities. They think Gorbag may act as an initial access broker that hands stolen credentials to other Russia-aligned operators.

The Campaign

The victims fall into roughly three groups:

Researchers suggest several overlapping motives: assessing battle damage after Russian airstrikes, monitoring local defence initiatives, and tracking war-crimes prosecutions.

The lures use official themes such as administrative fines and tax notices. Some were sent from compromised Ukrainian local-government mailboxes, so they look legitimate to recipients.

Timeline

Tradecraft

Indicators of Compromise

Network:

Files (SHA-1):

Vendor detection names: Win64/PSW.Agent.MA, PowerShell/ReverseShell.OB, VBA/TrojanDropper.Agent.DAT, PowerShell/Agent.EJI, LNK/Runner.FB.

Detection

# Inventory WinRAR versions (anything below 7.13 is vulnerable to CVE-2025-8088)
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*' |
  Where-Object DisplayName -like 'WinRAR*' | Select-Object DisplayName, DisplayVersion

Recommended Actions

  1. Update WinRAR to 7.13 or later on every endpoint, or remove it. Check bundled copies of UnRAR as well.
  2. Block or sandbox archive attachments from external senders, and look harder at messages from government domains, since compromised mailboxes are part of this campaign.
  3. If BeautyStealer may have run, revoke and reissue VPN profiles, certificates and e-signature keys, rotate passwords stored in browsers and KeePass, and invalidate session cookies.
  4. Block the network indicators above and check past logs for connections to them.
  5. Use application control to stop PowerShell and unsigned binaries from running out of user-writable folders.

Analyst Assessment

Gorbag is not technically sophisticated. It relies on an n-day WinRAR flaw, a public reverse shell and a plain stealer. Its value comes from who it targets: prosecutors, city councils and military logistics near the front line. A quick grab of credentials, VPN profiles and e-signature keys can give follow-on groups trusted access to Ukrainian state systems. The swap from Excel macros to CVE-2025-8088 shows how widely that WinRAR flaw is now used by Russia-aligned actors more than a year after the fix. Any organization that handles Ukraine-related work should treat outdated WinRAR installs as an active exposure.

REEF SENTINEL