Russia-Aligned Gorbag APT Exploits WinRAR CVE-2025-8088 to Deploy BeautyStealer Infostealer

A targeted cyberespionage campaign by Gorbag, a Russia-aligned threat actor exploiting WinRAR vulnerability CVE-2025-8088 to deploy BeautyStealer against Ukrainian organizations.

Active since at least February 2025, the group prioritizes law enforcement, justice institutions, frontline local administrations, and defense organizations, using compact malware designed for rapid intelligence collection rather than prolonged remote control

The findings, detailed in ESET’s “Gorbag: Orcs at the border” research presented at Virus Bulletin 2026, connect previously reported GIFTEDCROOK tooling with a broader espionage operation.

Earlier Arctic Wolf research documented GIFTEDCROOK’s progression from browser credential theft to document exfiltration in campaigns associated with UAC-0226.

Administrative fines, taxes, and military-related notices provided convincing pretexts. Once macros executed, VBA routines decoded Base64 payloads embedded in spreadsheet cells, wrote BeautyStealer into %ProgramData%, and launched it.

In early 2026, the operators shifted to weaponized RAR attachments exploiting CVE-2025-8088.

The path traversal flaw abuses alternate data streams to extract malicious files outside the user-selected directory. A decoy PDF conceals the deployment of an encrypted payload, a PowerShell loader, and a malicious Windows shortcut.

The shortcut lands in the Windows Startup folder, while the loader and encrypted payload are deposited under %ProgramData%.

At subsequent user logon, the shortcut invokes PowerShell to load the next stage. This execution foothold supports delivery despite Gorbag’s broader preference for short-lived collection rather than durable backdoor access.

ESET originally discovered the vulnerability during RomCom attacks in July 2025. WinRAR 7.13, released July 30, 2025, fixed the issue; Windows versions through 7.12 are affected.

Gorbag’s later adoption demonstrates continued exploitation of an already patched weakness, not a newly discovered zero-day.

Written in C++, BeautyStealer collects cookies, saved passwords, and browser profile data from Chrome, Edge, Opera, and Firefox.

Gorbag APT Campaign

ESET researchers said that, Gorbag primarily distributed spearphishing emails carrying macro-enabled Excel spreadsheets, sometimes through compromised Ukrainian government accounts.

It also harvests OpenVPN configurations and selected documents from Desktop, Documents, and Downloads directories, extending collection across removable media and mapped network drives, according to ESET’s supplied campaign account.

Its targeting includes KeePass databases, Java keystores, VPN configuration files, and Ukrainian electronic-signature key files using the .zs2 extension.

These selections extend collection beyond routine documents into material associated with authentication and access.

Collected data is compressed and uploaded through Telegram’s sendDocument API or attacker-controlled HTTPS infrastructure implementing FastAPI.

Across versions 0.9 through 2.0, BeautyStealer gained file collection, stronger string obfuscation, revised command-and-control protocols, and RC4 encryption.

Its latest generation replaces earlier batch-based cleanup with Windows API-driven deletion mechanisms.

Approximately one quarter of identified targets belong to Ukraine’s justice and law enforcement sectors, with another quarter comprising local governments.

Other victims include defense organizations and a transportation hub supporting foreign military aid. ESET assesses that these choices could support monitoring of investigations, local defense preparations, and damage from Russian strikes.

Gorbag previously used Prime ReverseShell, a PowerShell command shell packaged with PS2EXE. One variant included instructions attempting to mislead AI reviewers; ESET’s tests were unsuccessful.

Researchers also suggest Gorbag might supply stolen credentials to other actors, although subsequent intrusion stages remain unobserved.

IOCs

SHA-1	Filename	Detection	Description
C17369B4B49113D07F080DF832E218156FB0940F	N/A	Win64/PSW.Agent.MA	Spearphishing email.
A5E0A82BF6CC302A20D917235643B748F73FCC27	Windows Telemetry	PowerShell/ReverseShell.OB	Prime ReverseShell.
E27E0D0A4B308F9B6B0469159931EB5E343E7FF8	додаток податкова.xlsm	VBA/TrojanDropper.Agent.DAT	XLS lure document.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.