BeautyStealer

Gorbag hackers exploit WinRAR flaw to steal credentials from Ukrainian agencies

Gorbag, a Russia-aligned group active since at least February 2025, targets Ukrainian government, law enforcement, justice and frontline local bodies. In early 2026 it switched from malicious Excel phishing to RAR archives exploiting CVE-2025-8088, a WinRAR◆ path traversal flaw, to drop a PowerShell loader that runs at startup. The BeautyStealer✱ infostealer harvests browser data, OpenVPN configs, KeePass databases and Ukrainian electronic signature keys, and ESET◼'s report of 3 November links the activity to GIFTEDCROOK, tracked by CERT-UA as UAC-0226.