Gorbag Cyberespionage Group Targets Ukrainian Entities Using WinRAR Exploits

• •Gorbag has targeted Ukrainian law enforcement and local governments since February 2025.
• •The group exploits CVE-2025-8088 in WinRAR to deploy its infostealer malware.
• •Gorbag's tactics suggest it may act as an initial access broker for other threat actors.

The Russia-aligned Gorbag cyberespionage group has been actively targeting Ukrainian law enforcement, local governments, and defense sectors since February 2025. The group employs spear-phishing emails with malicious attachments to deliver its malware, primarily focusing on browser credentials and VPN configurations. Recent attacks have exploited a WinRAR vulnerability (CVE-2025-8088) to deploy a self-erasing infostealer known as BeautyStealer. This malware collects sensitive data and is believed to operate as an initial access broker, potentially sharing stolen information with other threat actors. The targeting aligns with Russian military interests, especially in areas affected by conflict. ESET researchers have documented the group's activities and their implications for Ukrainian security efforts. The ongoing campaign reflects a strategic approach to gather intelligence on Ukrainian governmental operations.