Malware

GIFTEDCROOK

According to CERT-UA, this stealer used by UAC-0226 is written in C/C++, targeting browser databases and using telegram for data exfiltration.

Indicators of Compromise 5

Filename BeautyStealer Filename GIFTEDCROOK Filename PSSW100AVB Filename Prime ReverseShell Filename macro-enabled Excel spreadsheet (.XLSM)

MITRE ATT&CK TTPs 4

T1027
Obfuscated Files or Information
Defense Evasion
 T1059.001
PowerShell
Execution
 T1071.001
Web Protocols
Command And Control
 T1204.002
Malicious File
Execution

Source Articles

Russia-Aligned Gorbag Hackers Exploit WinRAR Flaw to Deploy Data-Stealing Malware
Russia-aligned threat actor Gorbag has been targeting Ukrainian organizations, particularly in law enforcement, justice, and defense sectors, since at least February 2025. The group exploits the WinRAR vulnerability CVE-2025-8088 to deploy GIFTEDCROOK and later shifted to using BeautyStealer, a data-stealing malware that harvests browser data, VPN configurations, and sensitive documents. Attacks are initiated via spear-phishing emails with malicious macro-enabled Excel attachments, and the stolen data is exfiltrated through Telegram or FastAPI-based C2 servers, indicating potential use as an initial access broker.
hacker-news ·18h ago