Actively exploited Security news
Gorbag harvests data from frontline Ukrainian agencies with an old WinRAR flaw
On 3 November 2026 ESET Research published its analysis of Gorbag, a previously underreported Russia-aligned group. Since February 2025 it has sent targeted emails to Ukrainian justice and law enforcement bodies, border-area city councils and defence organisations. Since early 2026 it has also exploited WinRAR flaw CVE-2025-8088, which was patched back in July 2025.
Key points
- ESET has tracked Gorbag since February 2025. Every identified target is in Ukraine: roughly a quarter justice and law enforcement, a quarter frontline city councils, the rest defence and a logistics hub for foreign military aid.
- It used to send macro-enabled Excel files; since early 2026 it sends RAR archives that abuse CVE-2025-8088 to drop a .lnk shortcut into the Startup folder. The fix shipped in WinRAR 7.13 on 30 July 2025.
- The toolset is small: the Prime ReverseShell backdoor and BeautyStealer, which grabs browser data, OpenVPN configs and documents, exfiltrates them and deletes itself.
- The group goes for one-off collection rather than long-term access. ESET suggests it may hand stolen access to other Russia-aligned actors.
What happened
On 3 November 2026 ESET Research published its analysis of a group it named Gorbag, after presenting the findings at Virus Bulletin on 14 October. ESET describes the group as Russia-aligned and has seen highly targeted attacks from it since February 2025. Every victim identified so far is in Ukraine, many close to the border and the front line.
According to ESET, about a quarter of targets are Ukrainian justice and law enforcement bodies, another quarter city councils in frontline areas (nearly all of those cities were hit by Russian air strikes during the campaign), and the rest are in defence and logistics, including a publicly documented transport hub for foreign military aid. Part of the tooling – the GIFTEDCROOK infostealer – had already been reported by CERT-UA, which attributes it to UAC-0226.
How the attack works
Initial access. Lures use official themes such as fines and taxes and often come from hijacked mailboxes of Ukrainian local authorities to look credible. In 2025 they were .xlsm spreadsheets: once macros ran, payloads were decoded from cells, written to %ProgramData% and launched.
CVE-2025-8088. Since early 2026 Gorbag has sent RAR archives exploiting a path traversal flaw in WinRAR for Windows. Per the vendor, a crafted archive can write files outside the folder the user picked for extraction. The victim sees a decoy PDF while the archive drops a .lnk shortcut into the Startup folder, plus an encrypted payload and a PowerShell loader in %ProgramData%. The loader runs at the next logon. NVD rates the flaw CVSS 3.1 8.8.
Tooling.
| Tool | What it does (per ESET) |
|---|---|
| Prime ReverseShell | PowerShell reverse shell packed into a .NET binary; runs commands and returns output over HTTPS. One variant carried a code comment meant to convince AI tools the file was harmless – ESET says neither of the two AI assistants it tested was fooled. |
| BeautyStealer | C++ stealer (versions 0.9 to 2.0): cookies, passwords and history from Chrome, Edge, Opera and Firefox, OpenVPN configs, and documents from Desktop, Documents, Downloads, removable and mapped drives (including .kdbx, .rdp, .pfx, .ovpn, .zs2). It archives the haul, sends it to a Telegram chat or, from version 1.2, to a custom server, then deletes itself. |
ESET stresses that the group isn't after persistent access: it grabs what it can in one pass and cleans up. That, ESET says, may point to an initial access broker role for other actors.
Who is affected
Directly, Ukrainian government, justice and defence organisations. The WinRAR flaw, however, works against anyone running WinRAR, RAR or UnRAR for Windows, UnRAR.dll or portable UnRAR older than 7.13. Linux/Unix builds and Android are not affected. Organisations that work with Ukrainian authorities should treat this as relevant.
How to detect compromise
Indicators from ESET's post (network indicators defanged, SHA-1 hashes):
C17369B4B49113D07F080DF832E218156FB0940F spearphishing email (Win64/PSW.Agent.MA)
A5E0A82BF6CC302A20D917235643B748F73FCC27 Windows Telemetry – Prime ReverseShell
E27E0D0A4B308F9B6B0469159931EB5E343E7FF8 додаток податкова.xlsm – XLS lure
0589D2079FBEF814DC7BB95C4B3B555C8B933AF6 Повідомлення 4726-49.rar – malicious archive
89.44.9[.]186 Prime ReverseShell C&C (first seen 2025-03-28)
142.111.194[.]73 BeautyStealer exfiltration server (first seen 2026-06-02)The full list is in ESET's malware-ioc repository. Our hunting tips, based on ESET's description:
- New
.lnkfiles in Startup folders that launch PowerShell, and unexpected scripts or encrypted blobs in%ProgramData%. - Connections to the listed IPs, and outbound traffic to the Telegram API from machines where nobody uses Telegram.
- Short-lived processes that bulk-read browser profiles and OpenVPN files.
Our IOC extractor pulls clean indicator lists out of logs and reports, and the hash calculator checks suspicious attachments – both run entirely in your browser.
What to do
- Update WinRAR to 7.13 or later on every Windows machine. Check Help → About WinRAR, and don't forget UnRAR.dll bundled inside other software.
- Block macros in files from the internet and email (Office policy), and detonate archives from email in a sandbox.
- Hunt for the indicators in EDR, proxy and firewall logs, including retroactively.
- If you find a hit, rotate passwords saved in browsers, revoke sessions and cookies, replace VPN configs and
.pfxcertificates, and report to your national CERT.
Timeline
FAQ
Is CVE-2025-8088 a new vulnerability?
No. WinRAR fixed it in version 7.13 on 30 July 2025, and CISA added it to the Known Exploited Vulnerabilities catalog on 12 August 2025. What's new is Gorbag's campaign using it. WinRAR 7.13 or later blocks this technique.
Are 7-Zip or WinRAR on Linux affected?
The vendor says only Windows builds are affected: WinRAR, RAR and UnRAR for Windows, UnRAR.dll and portable UnRAR. Linux/Unix builds and RAR for Android are not. Neither the vendor nor ESET mentions 7-Zip.
Should I care if I'm not in Ukraine?
Check your WinRAR version. Other groups abuse old versions too – ESET first found the flaw in 2025 in attacks by RomCom. The Gorbag indicators matter most to organisations that work with Ukrainian government bodies or receive mail from them.
Why does BeautyStealer look for .zs2 files?
According to ESET, they hold private electronic signature keys issued by a Ukrainian accredited certification centre – enough to sign documents in the victim's name.
Sources
Spotted a mistake? Let us know and we will correct it openly.
Related
Actively exploited
ScreenConnect attacks on managed service providers: ConnectWise disables RMM+ extensions
Late on 11 November 2026 ConnectWise said it is investigating unauthorized access to certain partner ScreenConnect environments, mostly managed service providers (MSPs). Its working theory is that attackers abused third-party extensions from the RMM+ family, which can run remote commands, and used them to push their own remote-access clients into customer networks. ConnectWise says it has found no vulnerability in ScreenConnect itself.
Actively exploited
Citrus ransomware gets in through contractor accounts and spreads Sn00py by Group Policy
On 11 November 2026 Kaspersky described Citrus, a previously undocumented Russian-speaking ransomware group. It logged in with low-privilege contractor accounts, hid its traffic in VLESS tunnels disguised as Yandex, impersonated a domain controller through an AD CS flaw patched in July and finally pushed its Go-based Sn00py encryptor to the whole domain through Group Policy.
Actively exploited
AhsayCBS intrusion: attackers left webshells, a cryptominer and a Python implant on backup servers
On 9 November 2026 Huntress published a deep dive into an intrusion that hit three AhsayCBS backup servers through CVE-2026-105133 and CVE-2026-105134. The flaws have been public and patched since October 2026 and are listed in CISA's KEV catalog. What's new is what the attacker left behind: five webshell families, a cryptominer, a Python implant talking to an unidentified C2, tunneling tools and theft of Veeam credentials. Patching does not remove any of it.