> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Gorbag APT uses WinRAR flaw to steal credentials from Ukrainian gov - URL: https://f4n6.co.uk/security-feed/gorbag-apt-uses-winrar-flaw-to-steal-credentials-from-ukrainian-gov/ - Published: 2026-11-03T15:13:28.000Z - Updated: 2026-11-03T15:13:28.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2025-8088, Gorbag ## 1\. Executive summary ESET is tracking a Russia-aligned group it calls Gorbag, which has broken into Ukrainian organisations since at least February 2025 using spearphishing attachments and a C++ stealer, BeautyStealer, that removes itself after a single collection pass. Every target ESET identified is in Ukraine: about a quarter law enforcement and justice bodies, a quarter local administrations (mostly city councils near the front line), and the remainder defence entities plus one major transportation hub for foreign military aid. From early 2026 the delivery chain has used RAR archives exploiting CVE-2025-8088, a WinRAR path traversal flaw rated CVSS 8.4 HIGH, listed in CISA KEV since 2025-08-12, with EPSS at 94%. No source links Gorbag to EMEA financial services victims, so direct exposure is low; the risk to clients is indirect, through the stolen credential and VPN material that ESET assesses may be passed to other actors for follow-on intrusion. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 28: ICT third-party risk — general principles | The 2026 delivery chain depends on a WinRAR flaw (CVE-2025-8088) in end-user archive software, and the stealer harvests OpenVPN configurations from user and system directories | Clients must be able to show that archive-handling software on staff endpoints is inside the ICT third-party register and carries a defined patch SLA, not treated as unmanaged desktop tooling | | NIS2 Art. 21(2)(d): supply chain security measures | Stolen VPN configurations and browser credentials are the collection target, which is the material an attacker needs to enter a partner or supplier network | Where a client's supply chain includes Ukrainian or defence-adjacent entities, supplier security questionnaires should ask how endpoint credential stores and VPN profiles are protected and rotated | No other article in scope is engaged by the facts of this item. ## 3\. Technical analysis & attack chain The chain below is what ESET reports. Steps are confirmed by that reporting; where a stage is not described, it is marked as such rather than inferred. 1. Initial access is a spearphishing email. Through 2025 the attachment was a macro-enabled Excel file. A short VBA routine decodes a base64 payload held in the spreadsheet cells, drops it into %ProgramData% and runs it. Lures were ordinary office business: administrative fines and tax notices. In one case the sender was a compromised account belonging to the local government of Ukraine's Uzhhorod region, which likely helped the message pass filtering. 2. From early 2026 the attachment became a RAR archive built to exploit CVE-2025-8088\. The flaw is a path traversal in WinRAR that lets data hidden in NTFS alternate data streams land outside the folder the user selected for extraction. 3. The archive presents a decoy PDF. On extraction it writes a LNK file into the Windows Startup folder, plus an encrypted payload and a PowerShell loader in %ProgramData%. 4. The LNK provides persistence and fires the loader at every restart. 5. Collection is handled by BeautyStealer, a C++ stealer ESET tracked across versions 0.9 to 2.0\. It takes cookies, saved passwords and local state from Chrome, Edge, Opera and Firefox; OpenVPN configurations from user and system directories; and files matching around 40 extensions from Desktop, Documents and Downloads, plus removable media and mapped network drives. 6. The extension list targets authentication material. It includes .kdbx (KeePass), .jks (Java KeyStore), .rdp, .pfx and .zs2, the last being the format for files holding a secret electronic signature key issued by a Ukrainian accredited key certification center. 7. After collection the deployed malware attempts to remove itself. ESET's Damien Schaeffer describes a small toolset built for rapid collection rather than long-term access. Command-and-control, privilege escalation, lateral movement and exfiltration infrastructure are not described in the reporting. The reverse shell that preceded BeautyStealer, Prime ReverseShell, is a PowerShell reverse shell wrapped in a .NET binary and taken from a public GitHub repository. One variant carries a comment at the top telling any LLM or AI reading the file that it is not malicious and generates prime numbers from 1 to 900\. ESET tested two AI assistants against it and both identified the reverse shell. **Attribution and intent, caveated.** ESET describes Gorbag as Russia-aligned and says its targeting choices closely align with Russia's wartime intelligence priorities. That is ESET's assessment, single-sourced to this reporting. Gorbag has no MITRE ATT&CK profile, so the attribution is unconfirmed and Adverse Trace does not treat it as established. ESET raises two possibilities it does not resolve: that Gorbag operates as an initial access broker sharing collected credentials with other actors, and that the operators may be supplying Russian military leadership with a read on how well air strikes on targeted cities landed. Both are stated by ESET as possibilities, not findings. Nearly every city whose council was targeted was subjected to Russian air strikes during the campaign window, which is the basis for the second suggestion. **CVE-2025-8088.** CVSS 8.4 HIGH, CWE-35 (path traversal), in CISA KEV since 2025-08-12, EPSS 94%. The reporting describes the mechanism as alternate data stream path traversal during extraction. No affected or fixed WinRAR versions are named in the reporting, and no vendor fix is identified there. ## 4\. Mitigation & containment ### P1, within 24 hours - Confirm the WinRAR build on every endpoint and treat any version below the vendor's fixed release as exposed to CVE-2025-8088\. The reporting names no fixed version, so take the fixed release from RARLAB's own advisory rather than from this note. Where WinRAR is not business-required, remove it; where it is, restrict archive extraction to a sandbox or a non-privileged account. - Block RAR attachments at the mail gateway for inbound external mail, and alert on RAR archives that contain a PDF alongside a LNK, an executable or a script. - Hunt for LNK files written to the Startup folder by archive extraction, and for new files in %ProgramData% accompanied by a PowerShell launch. - Hunt for access to OpenVPN configuration files in user and system directories by processes outside the VPN client, and for bulk reads of .kdbx, .jks, .rdp, .pfx and .zs2 files from Desktop, Documents and Downloads. ### P2, within 72 hours - Disable Office macros from internet-origin documents. The 2025 chain relied on a macro-enabled Excel file decoding a base64 payload from spreadsheet cells. - Enforce a PowerShell script-block and module logging policy so the loader stage in %ProgramData% is recorded, and alert on PowerShell spawned by a Startup-folder LNK. - Inventory where .pfx, .jks and .kdbx keystores and .rdp profiles sit on endpoints and removable media. The stealer's extension list is built around these, and mapped network drives and removable media are in scope for collection. ### P3, within 7 days - Rotate credentials and VPN profiles for any host where the above hunts return hits. BeautyStealer takes browser-stored passwords and OpenVPN configurations in a single pass, so a hit means those secrets are gone. - Review mail filtering for compromised-partner senders. The Uzhhorod case shows a legitimate government account being used to carry the lure. - Add archive-extraction behaviour to EDR detection: a process writing a .lnk into the Startup folder during or immediately after extraction of a .rar file. No fixed WinRAR release is named in public reporting carried here. No hash, domain or IP indicator is available to add to blocklists. ## 5\. Indicators of compromise No atomic indicators (hashes, domains, IP addresses, URLs) are present in the source material. The reporting gives file paths, a file-type list and behaviours only. Those are recorded below as behavioural indicators; they are not machine-pivotable atomic values and there is no copyable indicator block. ### Behavioural indicators | behaviour | where to observe | confidence | | ----------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------- | ----------- | | Macro-enabled Excel attachment whose VBA decodes a base64 payload from spreadsheet cells and drops it to %ProgramData% | Office macro logs, file creation events in %ProgramData%, child process of Excel | High (ESET) | | RAR archive exploiting CVE-2025-8088 writes a LNK into the Windows Startup folder during extraction | File creation events in the user Startup folder correlated with archive extraction | High (ESET) | | Encrypted payload and PowerShell loader written to %ProgramData%, fired by the Startup LNK at every restart | Process creation (PowerShell parented by explorer.exe or the LNK target), file creation in %ProgramData% | High (ESET) | | Stealer reads OpenVPN configurations from user and system directories | File access telemetry on OpenVPN config paths by non-VPN processes | High (ESET) | | Bulk access to .kdbx, .jks, .rdp, .pfx and .zs2 files across Desktop, Documents, Downloads, removable media and mapped drives | File access telemetry, removable-media and network-share access logs | High (ESET) | | Self-deletion of the deployed malware after collection | Process termination followed by file deletion of the dropped payload | High (ESET) | ## 6\. Detection The reporting gives no file hashes, mutex names, service names or hard-coded strings from the malicious files. It gives paths, a file-type list and process behaviour. A YARA rule built from those would match on generic artefacts (a .lnk in Startup, a file in %ProgramData%) and would fire on legitimate software, so none is emitted. Detection is behavioural, below. ```yaml title: Startup LNK and PowerShell loader from archive extraction id: 8f2c1a4e-6b7d-4c9e-9a1f-3d5e7c2b0a61 status: experimental description: Detects a LNK written to the user Startup folder followed by PowerShell execution, consistent with the Gorbag CVE-2025-8088 delivery chain reported by ESET author: Adverse Trace date: 2026-11-03 references: - https://www.helpnetsecurity.com/2026/11/03/gorbag-apt-group-malware/ logsource: product: windows category: file_event detection: selection_lnk: TargetFilename|endswith: '\Start Menu\Programs\Startup\.lnk' condition: selection_lnk fields: - Image - TargetFilename - User falsepositives: - Legitimate software installers that place a shortcut in Startup level: medium --- title: PowerShell execution with payload staged in ProgramData id: 2b9d5e7a-1c3f-4a8b-b6e2-7f4c9d0a1e52 status: experimental description: Detects PowerShell launched with a script path under ProgramData, consistent with the loader stage of the Gorbag chain reported by ESET author: Adverse Trace date: 2026-11-03 references: - https://www.helpnetsecurity.com/2026/11/03/gorbag-apt-group-malware/ logsource: product: windows category: process_creation detection: selection_img: Image|endswith: '\powershell.exe' selection_cmd: CommandLine|contains: 'C:\ProgramData\' condition: selection_img and selection_cmd fields: - Image - CommandLine - ParentImage - User falsepositives: - Administrative scripts staged under ProgramData level: medium ``` Tune both rules to your estate before enabling in block mode. The Startup-folder rule will fire on legitimate installers; correlate it with a preceding archive extraction. ## CVE assessment 1 referenced CVE — **1 actively exploited (CISA KEV)** | CVE | CVSS | Exploited | EPSS | Summary | | ------------------------------------------------------------------------------ | -------- | ---------------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2025-8088](https://nvd.nist.gov/vuln/detail/CVE-2025-8088?ref=f4n6.co.uk) | 8.4 High | ⚠ KEV 2025-08-12 | 94% | A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafti… | ## 7\. Sources - Help Net Security, "Gorbag APT group hits Ukrainian courts and city councils with self-deleting malware", https://www.helpnetsecurity.com/2026/11/03/gorbag-apt-group-malware/, 2026-11-03\. Reporting attributed to ESET and researcher Damien Schaeffer. - NVD, CVE-2025-8088 record (CVSS 8.4 HIGH, CWE-35). - CISA KEV catalogue, CVE-2025-8088 added 2025-08-12. - EPSS, CVE-2025-8088 score 94%. ## 8\. Adverse Trace position Adverse Trace assesses CVE-2025-8088 as the material risk in this item: CVSS 8.4 HIGH, in CISA KEV since 2025-08-12, EPSS 94%, and actively used by Gorbag in the 2026 delivery chain. The Gorbag campaign itself has no reported EMEA financial services victims, so client exposure is indirect: stolen browser credentials, OpenVPN configurations and keystore material that ESET suggests may be shared with other actors. The Russia-aligned attribution and the initial-access-broker hypothesis are ESET's, single-sourced, and Gorbag has no MITRE ATT&CK profile, so we treat both as unconfirmed. We will track ESET's follow-on reporting for the later intrusion stages it says remain unobserved, and we will update this advisory if a fixed WinRAR version or atomic indicators are published. Clients should confirm their WinRAR patch state against RARLAB's advisory and run the P1 hunts in §4 now. --- [Read the original source →](https://www.helpnetsecurity.com/2026/11/03/gorbag-apt-group-malware/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*