Threat actor · 1 source · latest 43m

Russia-aligned Gorbag group exploits WinRAR flaw to deploy BeautyStealer against Ukraine

THREAT ACTORWinRARredteam/daily · 1 source

Severity: High
Exploited: Yes
Sources: 1

What happened

Gorbag, a Russia-aligned threat actor, is running a targeted espionage campaign against Ukrainian organisations by exploiting CVE-2025-8088 in WinRAR to deploy the BeautyStealer infostealer. The group has been active since at least February 2025 and focuses on law enforcement, justice institutions, frontline local administrations and defence organisations. Its compact malware is built for rapid intelligence collection rather than long-term remote control.

For IT people · Written by AI from 1 source · Wrong?

What to do

Check whether WinRAR is installed on your systems and confirm it is updated to a version that fixes CVE-2025-8088.
Treat unexpected archive files from unknown senders with caution until the patch is applied.

Written by AI from the sources, checked against them

Read the full story at the source