Vulnerabilities

Gorbag exploits old WinRAR flaw to steal Ukrainian data

By Yaali. November 4, 2026, 6 min read, Vulnerabilities, Threat intel, Windows.

ESET's Gorbag group uses WinRAR CVE-2025-8088 to plant BeautyStealer in Ukrainian agencies. How the archive trick works, what it takes, and how to check.

ESET published research on November 3 about Gorbag, a Russia-aligned espionage group that has been stealing data from Ukrainian organizations since at least February 2025. Since early 2026 its phishing emails carry RAR archives that exploit CVE-2025-8088, a WinRAR path traversal flaw fixed in version 7.13 in July 2025. Opening the archive in an older WinRAR shows a harmless PDF while quietly planting a stealer that starts at the next logon.

Every victim ESET found is in Ukraine, but the technique works against any Windows machine with WinRAR 7.12 or older, and WinRAR does not update itself. Any copy installed by hand and never touched since is still vulnerable. Trend Micro, which tracks overlapping activity as SHADOW-EARTH-066, and CERT-UA, which calls it UAC-0226, describe the same chain.

How CVE-2025-8088 works

NTFS, the Windows file system, lets a file carry extra named data streams alongside its main content, called alternate data streams (ADS). RAR archives can store these streams so they survive compression. WinRAR 7.12 and earlier did not clean ..\ sequences out of the stream names when extracting, so a stream name could climb out of the folder the user chose and write a file anywhere the user's account can write.

Gorbag's archives use that to drop three things at once. The victim sees a decoy PDF and nothing else. Hidden streams write a shortcut (LNK) file into the user's Windows Startup folder, plus an encrypted payload and a PowerShell loader into %ProgramData%. The next time the user logs on, Windows runs the shortcut, the shortcut runs the loader, and the loader decrypts and starts the stealer. No macro prompt appears and the user does not have to run anything beyond opening the archive.

The flaw is not new. ESET reported it in 2025 after finding the RomCom group using it as a zero-day, and CISA added it to its Known Exploited Vulnerabilities catalog on August 12, 2025. Gamaredon has used it against Ukrainian targets as well. Sources give two scores: The Hacker News and the PT vulnerability database list CVSS 8.8, while Trend Micro cites 8.4. Either way it is a high-severity bug with public exploitation for more than a year.

What Gorbag is doing

ESET puts the targets in three groups. About a quarter are law enforcement and justice bodies. Another quarter are local administrations, mostly city councils near the front line. The rest are in the defense sector, including one organization publicly documented as a major transport hub for foreign military aid. Nearly every targeted city was hit by Russian air strikes during the campaign window, and ESET suggests the stolen material may help assess how well those strikes landed.

The lures are dull on purpose: administrative fines and tax notices. One email came from a compromised local government account, which made it look routine to the people receiving it. In 2025 the attachments were macro-enabled Excel files (.xlsm) whose VBA code decoded a base64 payload stored in the spreadsheet cells and dropped it into %ProgramData%. The move to WinRAR archives in early 2026 removed the macro prompt, which is the one step a trained user might refuse.

The payload is BeautyStealer, a C++ stealer ESET tracked from version 0.9 to 2.0. It descends from GIFTEDCROOK, the stealer CERT-UA attributed to UAC-0226 and Trend Micro found at the end of the same WinRAR chain. In one pass it takes:

• cookies, saved passwords and local state from Chrome, Edge, Opera and Firefox
• OpenVPN configuration files from user and system folders
• files with about 40 extensions from Desktop, Documents and Downloads, plus removable media and mapped network drives

The file list includes .kdbx (KeePass databases), .rdp (Remote Desktop connection files), .pfx certificates with private keys, .jks Java keystores and .zs2, the key format for Ukrainian qualified electronic signatures. The data is compressed and sent to the attackers, first through a Telegram chat and from version 1.2 to a custom server built on the FastAPI web framework. Then the stealer deletes itself.

That self-deletion matters for response. Gorbag does not keep a foothold, so ESET suspects it works as an initial access broker, handing VPN profiles, saved logins and signing keys to other Russian operators who come back later. A machine that looks clean today may still have leaked everything needed to log in to your VPN tomorrow.

Before BeautyStealer, the group used Prime ReverseShell, a PowerShell reverse shell packed into a .NET executable with PS2EXE and adapted from a public GitHub project. One sample carried a comment addressed to AI tools, claiming the file was harmless. ESET tested two AI assistants against it and both still identified it as a reverse shell.

What to do

Find and update every WinRAR. Version 7.13 or later fixes CVE-2025-8088. WinRAR has no automatic update and no built-in Group Policy updates, so push the current installer through Intune, Configuration Manager or whatever deployment tool you use. Check the version from the file itself rather than the installed programs list: (Get-Item "C:\Program Files\WinRAR\WinRAR.exe").VersionInfo.ProductVersion in PowerShell, and search for portable copies in user profiles too.

If you cannot update today, uninstall WinRAR where nobody needs it, since File Explorer in Windows 11 has opened RAR files on its own since 2023. Quarantine RAR attachments at the mail gateway, or at least those from outside senders. Trend Micro also notes that RAR5 archives carrying ADS entries can be spotted by inspecting their service headers, if your gateway supports custom rules.

Check for signs of compromise:

1. List the contents of %AppData%\Microsoft\Windows\Start Menu\Programs\Startup for every user and look for shortcut files nobody recognises, especially ones created at the same time a RAR was opened.
2. Look in C:\ProgramData for small, oddly named files with no installer behind them, and for PowerShell scripts or encrypted blobs created alongside a Startup shortcut.
3. In endpoint telemetry, search for an LNK in a Startup folder launching cmd.exe or powershell.exe that reads a file from C:\ProgramData.
4. Because BeautyStealer deletes itself, look for what it leaves behind: Prefetch entries, EDR process history and outbound uploads from a workstation shortly after logon.
5. Compare hashes and addresses against ESET's published indicators in the eset/malware-ioc GitHub repository, in the gorbag folder.

If you find a hit, assume everything on that list was taken. Reset passwords saved in the browsers and revoke active sessions, since stolen cookies outlive a password change. Reissue the user's VPN profile and certificates, and rotate anything stored in KeePass databases the machine could reach. Replace any .pfx certificate or signing key that sat in the scanned folders, and change the passwords behind saved .rdp files.

Archivers sit outside the patch cycle

WinRAR, 7-Zip, PDF readers and similar tools often arrive on machines one at a time and never show up in the monthly Windows update. A flaw fixed in July 2025 is still doing damage in late 2026 because nobody owns those copies. Add them to the software inventory and the patch schedule with a named owner, the same as the browser.

If you want to know where old archivers and other unmanaged software sit in your estate, our attack surface management work maps it, and security operations can hunt for the Startup shortcut pattern above. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

Sources: ESET WeLiveSecurity, The Hacker News, Help Net Security, Infosecurity Magazine, Trend Micro, The Hacker News on CVE-2025-8088, Security Affairs on the CISA KEV addition.