A hacking group researchers call Gorbag has spent the better part of two years quietly working its way through Ukrainian government and justice institutions, and its latest tool of choice is unusually mundane: a booby-trapped RAR archive. New research links the group to an aggressive credential-theft campaign that leans on a WinRAR vulnerability to plant malware capable of siphoning browser logins, VPN configurations, and sensitive documents before erasing its own tracks.

Who Gorbag Is Targeting

According to a report published by ESET on WeLiveSecurity, Gorbag has been active since at least February 2025 and shows a clear preference for government agencies, law enforcement bodies, courts and justice institutions, local administrations near the front line, and organizations tied to defense work. Roughly a quarter of the identified targets sit in justice or law enforcement, and another quarter are local government bodies, many of them city councils operating close to active conflict areas.

Researchers believe that focus isn’t accidental. Organizations in those categories often hold information about war-crimes investigations, infrastructure damage assessments, and local defense planning, the kind of material that would interest an intelligence-gathering operation even when the stolen credentials don’t immediately unlock anything dramatic on their own. ESET frames this as an assessment rather than a confirmed motive, but the pattern of targets lines up with the theory.

From Rigged Spreadsheets to a WinRAR Exploit

Gorbag’s methods have evolved over the course of the campaign. Throughout 2025, the group mainly relied on targeted phishing emails carrying malicious Excel attachments, often themed around routine government business like administrative fines or tax notices. In at least one case, the lure email came from a compromised Ukrainian local-government mailbox, lending the message a false sense of legitimacy that pure spoofing couldn’t match. When a recipient opened the file and enabled macros, a VBA routine would quietly decode malicious content hidden inside spreadsheet cells, write it to disk, and launch the group’s main stealer.

In early 2026, the group shifted tactics again, moving to malicious RAR archives that exploit CVE-2025-8088, a WinRAR path-traversal vulnerability that had already shown up in earlier RomCom phishing operations before Gorbag adopted it. The flaw lets specially crafted archive contents escape the folder a victim chose for extraction, using Windows’ alternate data streams feature to drop files elsewhere on the system. In Gorbag’s version of the attack chain, extracting the archive shows the victim a harmless-looking decoy PDF while secretly planting a shortcut in the Windows Startup folder, along with an encrypted payload and a PowerShell loader. The shortcut then triggers the loader every time the infected machine restarts, giving the malware persistence without needing a second round of phishing.

Meet BeautyStealer

The payload at the center of the operation is a C++ information stealer that ESET has named BeautyStealer, used alongside an earlier and simpler tool called Prime ReverseShell. Rather than setting up extensive remote control over infected machines, BeautyStealer is built for speed: it gathers credentials and documents in a single pass, sends the haul to attacker-controlled infrastructure, and then attempts to delete itself to reduce the chance of discovery.

ESET’s report also ties this activity to previously documented GIFTEDCROOK browser-credential-theft operations, which Ukraine’s CERT-UA had attributed to a group tracked as UAC-0226. The overlap suggests Gorbag’s work may be part of a broader intelligence-gathering effort rather than an isolated campaign, with researchers noting that the stolen credentials could plausibly feed further intrusions carried out by other, separate groups, though that connection remains unconfirmed.

What Organizations Can Do

• Update WinRAR immediately. CVE-2025-8088 has been patched, and any installation that hasn’t been updated since the fix shipped remains exposed to this exact technique.
• Treat unsolicited archive attachments, especially ones referencing fines, taxes, or administrative notices, with the same suspicion as macro-enabled spreadsheets.
• Audit the Windows Startup folder on sensitive machines for unfamiliar shortcuts, which is the persistence mechanism this campaign relies on.
• Rotate credentials and VPN configurations on any machine suspected of compromise, since BeautyStealer is built specifically to harvest exactly that kind of data.
• Government and justice-sector organizations operating near conflict zones should assume they are higher-priority targets and adjust email filtering and endpoint monitoring accordingly.

Gorbag’s shift from macro-laden spreadsheets to a weaponized archive format shows how quickly espionage-focused groups retool once a new vulnerability becomes available, and underscores why patching consumer-grade software like WinRAR matters just as much in high-stakes government networks as it does on home PCs.