ESET Details Gorbag Infostealer Campaign Targeting Ukrainian Organizations
Summary
ESET says the Russia-aligned Gorbag group targeted Ukrainian organizations with phishing and malicious RAR archives exploiting CVE-2025-8088, stealing browser credentials, VPN configurations and files with its BeautyStealer infostealer.
Key points
- ESET tracks Gorbag as a Russia-aligned cyberespionage group targeting Ukrainian law enforcement, defense organizations and local governments.
- Since February 2025, Gorbag has used spear-phishing emails posing as official government notices, including malicious macro-enabled Excel attachments.
- In early 2026, the group began using weaponized RAR archives that exploit the WinRAR path traversal vulnerability CVE-2025-8088.
- The archives display a PDF decoy and drop a Windows shortcut, an encrypted payload and a PowerShell loader; the shortcut triggers the loader at system restart.
- BeautyStealer collects browser cookies, stored passwords and local data, OpenVPN configurations, and files including Office documents, archives and emails.
- ESET says Gorbag's tools gather credentials and other material for possible follow-on activity; its potential role as an initial access broker remains a hypothesis.
Article Details
- Attack Vectors
- Since February 2025, Gorbag has delivered malicious attachments in spear-phishing emails posing as official government communications about administrative fines or taxes.
- An earlier delivery chain used a macro-enabled Excel spreadsheet with a payload hidden in spreadsheet cells; a script decoded the payload, saved it to a system folder, and ran it.
- Beginning in early 2026, weaponized RAR archives exploited CVE-2025-8088 in WinRAR. Opening an archive on a vulnerable system displayed a PDF decoy and dropped a Windows shortcut, an encrypted payload, and a PowerShell loader.
- The shortcut triggered the loader on system restarts. BeautyStealer collected browser data, OpenVPN configurations, and selected local files, then used exfiltration and self-deletion mechanisms.
MITRE ATT&CK
T1005 · Data from Local SystemBeautyStealer collected selected local files, including documents, archives, emails, and VPN configurations.T1027.009 · Embedded PayloadsAn earlier Excel attachment concealed a payload in spreadsheet cells for a script to decode.T1059.001 · PowerShellThe RAR archive delivery chain dropped a PowerShell loader.T1140 · Deobfuscate/Decode Files or InformationA script decoded the payload hidden in spreadsheet cells before saving and running it.T1204.002 · Malicious FileThe infection chains required the recipient to open a malicious Excel attachment or RAR archive.T1547 · Boot or Logon Autostart ExecutionA dropped Windows shortcut triggered the loader on each system restart to establish persistence.T1555.003 · Credentials from Web BrowsersBeautyStealer harvested cookies and stored passwords from Chrome, Edge, Opera, and Firefox.T1566.001 · Spearphishing AttachmentGorbag delivered malicious attachments in spear-phishing emails posing as official government communications.
CVE
People
Threat Actors
Malware
Products
EdgeC++, is Gorbag's main infostealer. It harvests cookies, stored passwords and local state from the Chrome, Edge, Opera and Firefox browsers, OpenVPN configurations from both user and system directories, and filesGoogle Chromein C++, is Gorbag's main infostealer. It harvests cookies, stored passwords and local state from the Chrome, Edge, Opera and Firefox browsers, OpenVPN configurations from both user and system directories, andMicrosoft Officebrowsers, OpenVPN configurations from both user and system directories, and files mostly from Microsoft Office, archives, emails and VPN configurations, Eset said.Mozilla Firefoxmain infostealer. It harvests cookies, stored passwords and local state from the Chrome, Edge, Opera and Firefox browsers, OpenVPN configurations from both user and system directories, and files mostly from MicrosoftOpenVPNIt harvests cookies, stored passwords and local state from the Chrome, Edge, Opera and Firefox browsers, OpenVPN configurations from both user and system directories, and files mostly from Microsoft Office, archives,OperaGorbag's main infostealer. It harvests cookies, stored passwords and local state from the Chrome, Edge, Opera and Firefox browsers, OpenVPN configurations from both user and system directories, and files mostly fromWinRARchanged in early 2026 and began delivering weaponized RAR archives. The threat actor exploited a WinRAR path traversal vulnerability, tracked as CVE-2025-8088, which allowed execution of arbitrary code by
Tools
Countries
RussiaA Russia-aligned cyberespionage group has been harvesting data from Ukrainian law enforcement, its defense sector and local governments near the front lines of the war with Russia, researchers found.Ukrainethreat actor likely aims to monitor or disrupt efforts to document and prosecute Russian war crimes in Ukraine, as well as investigations into Russian assets and collaborators.
Industries
DefenseA Russia-aligned cyberespionage group has been harvesting data from Ukrainian law enforcement, its defense sector and local governments near the front lines of the war with Russia, researchers found.GovernmentThe victim profile and immediate data exfiltration echo the findings in the Ukrainian government's threat intelligence report on Russia's cyber tactics in 2023.Law enforcementA Russia-aligned cyberespionage group has been harvesting data from Ukrainian law enforcement, its defense sector and local governments near the front lines of the war with Russia, researchers found.