A threat group aligned with Russia, known as Gorbag, has been exploiting a vulnerability in WinRAR to deploy data-stealing malware targeting Ukrainian entities. These attacks have predominantly focused on organizations in law enforcement, justice, and defense sectors, as revealed by ESET researcher Damien Schaeffer.
Targeted Attacks on Ukrainian Organizations
Active since February 2025, Gorbag has been exclusively targeting Ukrainian organizations. Their activities have significant overlap with groups tracked by CERT-UA as UAC-0226 and by Trend Micro as SHADOW-EARTH-066. The group employs a malware arsenal that includes the C/C++-based GIFTEDCROOK, which steals sensitive data from web browsers.
Trend Micro identified Gorbag’s usage of a patched WinRAR vulnerability (CVE-2025-8088) in June to deliver GIFTEDCROOK via a DLL sideloading chain. This malware aims to obtain sensitive information such as cookies, browsing history, and authentication data from browsers like Chrome and Firefox.
Malware Deployment and Tactics
Gorbag’s operations involve spear-phishing emails that use government-themed lures to induce malware downloads. In one instance, a macro-enabled Excel file was used to execute a VBA payload, which decodes and runs BeautyStealer, their main tool for data collection.
BeautyStealer captures data from web browsers, OpenVPN, and specific file extensions. Once the data is collected, it is sent to a Telegram chat or a custom server, after which BeautyStealer removes itself from the system, indicating a focus on one-time data gathering.
Implications and Future Outlook
The group’s attacks align with Russia’s wartime intelligence goals, suggesting that Gorbag may be an initial access broker for other malicious actors. ESET notes that these attacks represent the first phase of potentially more complex intrusion sequences.
Earlier in 2025, Gorbag used Prime ReverseShell, a tool identified by CERT-UA, to execute commands and send results back to a command server. Despite attempts to deceive AI detection tools, the malware’s true nature was successfully identified as a reverse shell.
Gorbag’s operations demonstrate that sophisticated malware is not always necessary for effective cyber espionage. Simple tools like infostealers and reverse shells suffice for their targeted intelligence efforts against Ukrainian organizations.
