Russia-Aligned Gorbag Hackers Exploit WinRAR Flaw to Deploy Data-Stealing Malware

Russia-aligned threat actor Gorbag has been targeting Ukrainian organizations, particularly in law enforcement, justice, and defense sectors, since at least February 2025. The group exploits the WinRAR vulnerability CVE-2025-8088 to deploy GIFTEDCROOK and later shifted to using BeautyStealer, a data-stealing malware that harvests browser data, VPN configurations, and sensitive documents. Attacks are initiated via spear-phishing emails with malicious macro-enabled Excel attachments, and the stolen data is exfiltrated through Telegram or FastAPI-based C2 servers, indicating potential use as an initial access broker.

AI-extracted · verify before operational use