---
title: Hunt: ESET's Gorbag uses WinRAR CVE-2025-8088 archives to drop a Startup-folder LNK and BeautyStealer, which grabs browser data, .ovpn, .kdbx and Ukrainian .zs2 signing keys and then deletes itself | ctxsec
url: https://ctxsec.com/items/hunt-gorbag-beautystealer-winrar-cve-2025-8088-ukraine
description: "ESET named Gorbag, a Russia-aligned group active since February 2025 that targets Ukrainian justice and law enforcement bodies, frontline city councils and the defense sector, including a hub for foreign military aid. It runs smash-and-grab collection rather than long-term access, which ESET says may mean it works as an initial access broker. Its tooling overlaps with GIFTEDCROOK, which CERT-UA attributes to UAC-0226. Since early 2026 its RAR lures exploit WinRAR path traversal CVE-2025-8088."
status: "official (ESET Research, Nov 3; Virus Bulletin 2026 white paper)"
published: 2026-11-03
---

> ESET named Gorbag, a Russia-aligned group active since February 2025 that targets Ukrainian justice and law enforcement bodies, frontline city councils and the defense sector, including a hub for foreign military aid. It runs smash-and-grab collection rather than long-term access, which ESET says may mean it works as an initial access broker. Its tooling overlaps with GIFTEDCROOK, which CERT-UA attributes to UAC-0226. Since early 2026 its RAR lures exploit WinRAR path traversal CVE-2025-8088.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-gorbag-beautystealer-winrar-cve-2025-8088-ukraine.md)

official (ESET Research, Nov 3; Virus Bulletin 2026 white paper)

2026-11-03

### Hunt: ESET's Gorbag uses WinRAR CVE-2025-8088 archives to drop a Startup-folder LNK and BeautyStealer, which grabs browser data, .ovpn, .kdbx and Ukrainian .zs2 signing keys and then deletes itself

- **Delivery:** in 2025, macro-enabled .xlsm lures themed as fines or taxes, sometimes sent from a compromised local-government mailbox, with the payload base64-encoded in spreadsheet cells and dropped into `%ProgramData%`. Since early 2026, RAR archives exploiting CVE-2025-8088 show a decoy PDF while writing a LNK into the Startup folder plus an encrypted payload and a PowerShell loader in `%ProgramData%`.
- **BeautyStealer (v0.9–2.0):** takes Chrome, Edge, Opera and Firefox cookies, passwords and Local State; OpenVPN configs; and files from Desktop, Documents, Downloads, removable media and mapped drives, including `.kdbx`, `.jks`, `.pfx`, `.rdp`, `.ovpn` and `.zs2` (Ukrainian qualified e-signature keys). It exfiltrates to a Telegram chat via `sendDocument` or, from v1.2, to a FastAPI C2, then deletes itself.
- **Prime ReverseShell:** a PS2EXE-wrapped PowerShell reverse shell. One variant carries a comment telling LLMs the file is a harmless prime-number generator.
- **IoCs (ESET):** 89.44.9[.]186 (Prime ReverseShell C2, M247); 142.111.194[.]73 (BeautyStealer exfil, EGIHosting); SHA-1 0589D2079FBEF814DC7BB95C4B3B555C8B933AF6 (malicious RAR), E27E0D0A4B308F9B6B0469159931EB5E343E7FF8 (.xlsm lure). The full list is in ESET's GitHub repo.

**Detection ideas:** WinRAR writing `.lnk` files into a Startup folder; new LNKs in Startup that launch PowerShell against a script in `%ProgramData%`; non-browser processes reading browser Login Data/Cookies followed by traffic to `api.telegram.org`; and WinRAR versions below 7.13 still deployed.

Sources: [ESET WeLiveSecurity: Gorbag: Orcs at the border harvesting intelligence from Ukraine (Nov 3)](https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/) · [ESET Research on X: Gorbag thread](https://x.com/ESETresearch/status/2117557431286862133)