Gorbag hackers exploit WinRAR flaw to steal credentials from Ukrainian agencies
- Severity
- High
- Exploited
- Yes
- Sources
- 2
What happened
Gorbag (linked by ESET to GIFTEDCROOK and CERT-UA's UAC-0226) exploits CVE-2025-8088, a WinRAR path traversal abusing NTFS alternate data streams, in malicious RAR archives to drop a decoy PDF, a Startup-folder shortcut, an encrypted payload and a PowerShell loader. The BeautyStealer C++ stealer (versions 0.9 to 2.0) targets Chromium and Firefox browser data, OpenVPN configs, KeePass, JKS and RDP files and Ukrainian e-signature keys, exfiltrating via Telegram sendDocument or a FastAPI server, with RC4 added in 2.0. The flaw is fixed in WinRAR 7.13; defenders should patch, hunt for the published file hashes and two IP addresses, and assume exposed credentials and signing keys need rotation.
For security analysts · Written by AI from 2 sources · Wrong?
What to do
- Update WinRAR to version 7.13, which fixes CVE-2025-8088.
- Check systems for the published indicators of compromise, including file hashes and the two IP addresses.
- Rotate browser-saved passwords, VPN credentials and any exposed electronic signature keys if compromise is suspected.
Written by AI from the sources, checked against them
Vulnerabilities
Full story timeline · 3 updates
Who reported · 2 outlets
Who and what is in it
Threat actors
Malware
Companies
Products
Government agencies