Gorbag Targets Ukrainian Organizations with BeautyStealer and WinRAR Exploitation

Summary

Gorbag is a Russia-aligned cyberespionage cluster. Its phishing campaigns target Ukrainian justice and law-enforcement agencies, municipal authorities near the front line, and defense-related organizations to acquire credentials and operational documents.

The operators initially delivered malware through macro-enabled spreadsheets and later adopted weaponized WinRAR archives. BeautyStealer extracts browser and VPN material, transfers selected files to external infrastructure, and deletes itself after collection, limiting the intrusion's visible footprint.

Background

Researchers have observed Gorbag activity since at least February 2025. Its early toolset included Prime ReverseShell , a PowerShell reverse shell packaged into a .NET executable with PS2EXE. That component has not observed since the group introduced its custom C++ stealer, BeautyStealer , which it tracked through versions 0.9 to 2.0.

All targets identified were in Ukraine. Roughly one-quarter belonged to justice or law enforcement, another quarter to local government, and the remainder included defense organizations and a military-aid transport hub. The public report does not give a total victim count. Separately documented GIFTEDCROOK activity has tooling overlap with operations that CERT-UA tracks as UAC-0226 .

Vulnerability Details

CVE ID	CVSS Score	EPSS Score	Affected Products
CVE-2025-8088	8.8 (High)	94.01%	WinRAR for Windows through 7.12

Attack Methodology

1. 1. Targeted email delivery: Spearphishing messages present administrative fines, taxes, or other governmental business.
2. 2. 2025 macro route: An .xlsm attachment contains VBA that decodes a base64 payload stored in spreadsheet cells and executes BeautyStealer from %ProgramData% when macros run.
3. 3. 2026 archive route: The campaign shifts to RAR files abusing the WinRAR flaw. A visible PDF decoy accompanies hidden malicious extraction targets. This is an alternative to the earlier spreadsheet route, not a subsequent step in it.
4. 4. Startup-triggered loading: On the archive route, the malicious extraction places an LNK in the Windows Startup folder and an encrypted payload plus PowerShell loader under %ProgramData% . The link launches the loader when the user next starts or restarts the system.
5. 5. Credential and document harvesting: BeautyStealer reads Chrome, Edge, Opera, and Firefox data, gathers OpenVPN settings, and searches user folders, removable storage, and mapped drives for selected documents and key material, including .zs2 signature keys.
6. 6. Staging and exfiltration: Harvested information is compressed into an archive. Different versions use Telegram's sendDocument API or a custom command-and-control service built with FastAPI.
7. 7. Post-theft removal: BeautyStealer cleans up after the transfer. Earlier releases use BAT scripts, while version 2.0 implements self-deletion directly through Windows API calls.

Indicators of Compromise (IOCs)

IP Addresses

• • 89.44.9[.]186 , Prime ReverseShell C&C, first seen 2025-03-28
• • 142.111.194[.]73 , BeautyStealer exfiltration server, first seen 2026-06-02

Behavioral Indicators

• • Suspicious .xlsm macro execution with embedded base64 content and a binary written to %ProgramData% .
• • Unanticipated .lnk creation in the Windows Startup directory.
• • Browser profile reads combined with collection of .ovpn , .kdbx , .jks , .zs2 , .rdp , or .pfx files.
• • Archive creation followed by Telegram sendDocument uploads or traffic to a custom FastAPI endpoint, then malware self-deletion.

MITRE ATT&CK Mapping

Technique ID	Technique Name	Tactic
T1583	Acquire Infrastructure	Resource Development
T1586.002	Compromise Accounts: Email Accounts	Resource Development
T1587.001	Develop Capabilities: Malware	Resource Development
T1588.001	Obtain Capabilities: Malware	Resource Development
T1588.005	Obtain Capabilities: Exploits	Resource Development
T1566.001	Phishing: Spearphishing Attachment	Initial Access
T1199	Trusted Relationship	Initial Access
T1059	Command and Scripting Interpreter	Execution
T1203	Exploitation for Client Execution	Execution
T1204.002	User Execution: Malicious File	Execution
T1547.001	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder	Persistence
T1070.004	Indicator Removal: File Deletion	Stealth
T1027.009	Obfuscated Files or Information: Embedded Payloads	Stealth
T1555.003	Credentials from Password Stores: Credentials from Web Browsers	Credential Access
T1539	Steal Web Session Cookie	Credential Access
T1217	Browser Information Discovery	Discovery
T1005	Data from Local System	Collection
T1560	Archive Collected Data	Collection
T1071.001	Application Layer Protocol: Web Protocols	Command and Control
T1567	Exfiltration Over Web Service	Exfiltration
T1048.001	Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Exfiltration

Visual Attack Flow

Mitigation

1. 1. Update the vulnerable archive stack: Replace WinRAR 7.12 or earlier with at least 7.13, released July 30, 2025, or a newer supported version. Review embedded Windows UnRAR.dll and command-line implementations for outdated dependencies.
2. 2. Control high-risk attachments: Apply strict handling to unsolicited government-themed .xlsm spreadsheets and .rar archives. Prevent untrusted VBA macros from running and examine RAR extraction behavior, not only visible PDF decoys.
3. 3. Hunt for startup artifacts: Investigate newly created Startup-folder LNK files paired with PowerShell scripts or encrypted binaries in %ProgramData% , particularly after a user opens an untrusted archive.
4. 4. Monitor data-theft patterns: Review unexpected reads of browser credential stores, OpenVPN settings, and Ukrainian .zs2 files, correlated with archive uploads through Telegram or unknown FastAPI services.
5. 5. Contain suspected exposure: Where collection is confirmed, isolate the device, invalidate compromised browser sessions, rotate exposed account or VPN credentials, and evaluate stolen private-key material before restoring access.