Gorbag hackers exploit WinRAR flaw to steal credentials from Ukrainian agencies
THREAT ACTORBeautyStealerredteam/daily · 2 sources
- Severity
- High
- Exploited
- Yes
- Sources
- 2
What happened
A Russia-aligned hacking group called Gorbag has been sending fake official-looking files to Ukrainian government, justice and local bodies. It uses a flaw in the WinRAR file tool to steal saved passwords, VPN settings and sensitive documents. The malware collects the data quickly and then tries to delete itself.
Like I’m new · Written by AI from 2 sources · Wrong?
What to do
- Update WinRAR to version 7.13, which fixes CVE-2025-8088.
- Check systems for the published indicators of compromise, including file hashes and the two IP addresses.
- Rotate browser-saved passwords, VPN credentials and any exposed electronic signature keys if compromise is suspected.
Written by AI from the sources, checked against them
Vulnerabilities
Full story timeline · 3 updates
Who reported · 2 outlets
GBHackersCyber Security News
Who and what is in it
Threat actors
Malware
Companies
Products
Government agencies