Russia-Aligned Gorbag Hackers Exploit WinRAR Flaw to Deploy Data-Stealing Malware
Summary: ESET reports that Gorbag, a Russia-aligned group active since at least February 2025, targets Ukrainian law enforcement, front-line local administrations, and defense organizations with simple infostealers delivered through spear-phishing emails using government-themed lures such as administrative fines or taxes. The group's BeautyStealer harvests browser data, VPN and RDP configurations, KeePass databases, and documents, compresses them to an archive, and sends them to an attacker-controlled Telegram chat or FastAPI command-and-control server before deleting itself from the host.
Why it matters: ESET raises the possibility that Gorbag is an initial access broker, meaning the theft of VPN configurations and credentials from a Ukrainian defense or justice entity could be the first stage of an intrusion chain whose later stages have not yet been observed.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-8088
- Related
- CVE-2025-8088: RARLAB WinRAR Path Traversal Vulnerability Known Exploited Vulnerabilities · Aug 12, 2025