Cybersecurity
Gorbag exploits WinRAR flaw to deploy stealers
ESET said the Russia-aligned Gorbag group had targeted Ukrainian organisations with stealers and a reverse shell, while Trend Micro linked earlier June activity to a patched WinRAR vulnerability.
- ESET said Gorbag had been active since at least February 2025 and had focused on Ukrainian targets.
- Damien Schaeffer said the activity overlapped with clusters tracked as UAC-0226 and SHADOW-EARTH-066.
- Trend Micro had attributed earlier June attacks to WinRAR CVE-2025-8088 and a DLL sideloading chain that executed GIFTEDCROOK.
- ESET said Gorbag had shifted to BeautyStealer by the end of December 2025, and that the malware removed itself after exfiltrating data.
- The article said two AI assistants still identified a prompt-injected sample as a reverse shell.
ESET said Gorbag had been active since at least February 2025 and had concentrated on Ukrainian targets, especially law enforcement, justice bodies, local administrations near the front and defence organisations. The report said the activity matched Russia's wartime intelligence priorities.
The same activity overlapped with clusters tracked by CERT-UA as UAC-0226 and by Trend Micro as SHADOW-EARTH-066. Trend Micro had also linked the group to June attacks that used a patched WinRAR flaw, CVE-2025-8088, to start DLL sideloading and run GIFTEDCROOK.
GIFTEDCROOK stole browser cookies, history and authentication data from Chrome, Edge and Firefox. ESET said the group also collected VPN settings and documents, which could indicate that it was passing material to other actors for later exploitation.
Schaeffer said Gorbag had moved entirely to BeautyStealer by the end of December 2025. That tool gathered selected files, compressed them and sent them to a Telegram chat or a FastAPI-based command-and-control server before deleting itself.
Earlier waves had used Prime ReverseShell, which CERT-UA had flagged in April 2025. ESET also said a script comment aimed at AI tools did not stop two assistants from recognising the file as a reverse shell.
Named in this story
People
- Damien Schaeffer
- the ESET researcher who described the activity
Companies
- ESET
- the security firm that produced the report
- Trend Micro
- the security firm that linked the activity to SHADOW-EARTH-066 and earlier WinRAR abuse
Organisations
- Gorbag
- the Russia-aligned threat actor behind the campaign
- UAC-0226
- CERT-UA's label for the overlapping activity cluster
- SHADOW-EARTH-066
- Trend Micro's label for the same activity cluster
Governments and agencies
- Computer Emergency Response Team of Ukraine
- the Ukrainian agency that tracked the cluster as UAC-0226
Products and systems
- GIFTEDCROOK
- the stealer used to take browser data
- BeautyStealer
- the later data-harvesting tool used by Gorbag
- Prime ReverseShell
- the reverse shell used in earlier attack waves
- WinRAR
- the archive tool whose flaw was abused in earlier attacks
- Google Chrome
- one of the browsers targeted for data theft
- Microsoft Edge
- one of the browsers targeted for data theft
- Mozilla Firefox
- one of the browsers targeted for data theft
- Opera
- one of the browsers targeted by the stealer
- OpenVPN
- the source of configuration files taken by the stealer
- Telegram
- the chat platform that received exfiltrated archives
- FastAPI
- the framework used by a custom command-and-control server
- Microsoft Office
- one of the file types BeautyStealer was set to collect
- KeePass
- the password database type BeautyStealer was set to collect
Places
- Ukraine
- the country whose organisations were targeted
How the source tells it
The piece was mostly restrained, but it used geopolitically loaded attribution and a small amount of speculative language about the group's role.
- threat framing geopolitical attribution and wartime-intelligence language
- speculation the group's role was raised as a possibility rather than a finding