Skip to content
OriginalSign in
Image: Infosecurity

Infosecurity

ESET says Gorbag targets Ukrainian officials with spyware

Part of the CVE-2025-8088 story · since 28 Jan

Developinglatest 1 hour ago23 articles9 outlets
28 Jan · SecurityWeek first16 Jun2 Aug18 SepNowThis article23rd of 23
  • Wed 28 Jan, 09:45 UTC. SecurityWeek, first report. APTs, Cybercriminals Widely Exploiting WinRAR Vulnerability. Cites a CVE in CISA KEV.
  • Wed 28 Jan, 10:50 UTC. The Hacker News, its first report on the story. Google Warns of Active Exploitation of WinRAR Vulnerability CVE-2025-8088. Cites a CVE in CISA KEV.
  • Wed 28 Jan, 23:36 UTC. Dark Reading, its first report on the story. Months After Patch, WinRAR Bug Poised to Hit SMBs Hardest. Cites a CVE in CISA KEV.
  • Thu 29 Jan, 02:55 UTC. SecurityOnline, its first report on the story. The “Zeroplayer” Arsenal: WinRAR Flaw CVE-2025-8088 Weaponized by Spies. Cites a CVE in CISA KEV.
  • Thu 29 Jan, 11:40 UTC. Security Affairs, its first report on the story. Nation-state and criminal actors leverage WinRAR flaw in attacks. Cites a CVE in CISA KEV.
  • Wed 4 Feb, 14:05 UTC. Check Point, its first report on the story. Amaranth-Dragon: Weaponizing CVE-2025-8088 for Targeted Espionage in the Southeast Asia. Cites a CVE in CISA KEV.
  • Wed 4 Feb, 15:10 UTC. The Hacker News. China-Linked Amaranth-Dragon Exploits WinRAR Flaw in Espionage Campaigns. Cites a CVE in CISA KEV.
  • Thu 5 Feb, 03:26 UTC. SecurityOnline. 10 Days to Exploit: Amaranth-Dragon Weaponizes WinRAR Flaw to Spy on SE Asia. Cites a CVE in CISA KEV.
  • Thu 5 Feb, 10:50 UTC. Security Affairs. China-linked Amaranth-Dragon hackers target Southeast Asian governments in 2025. Cites a CVE in CISA KEV.
  • Sun 8 Feb, 14:25 UTC. Security Affairs. SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 83. Cites a CVE in CISA KEV.
  • Wed 25 Feb, 16:01 UTC. Google Cloud, its first report on the story. Google: WinRAR CVE-2025-8088 abused by state actors to persist. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 16:32 UTC. The Hacker News. Kali Linux integrates Anthropic Claude AI to speed cyber attacks. Cites a CVE in CISA KEV.
  • Fri 6 Mar, 10:27 UTC. Securelist, its first report on the story. Q4 2025 Exploits Hit Windows and Linux, Spotlight CVE-2025-55182. Cites a CVE in CISA KEV.
  • Mon 1 Jun, 11:21 UTC. Infosecurity, its first report on the story. Ukrainian networks hit by stealth Gamaredon worm via WinRAR flaw. Cites a CVE in CISA KEV.
  • Thu 4 Jun, 11:41 UTC. Security Affairs. Gamaredon Uses WinRAR Vulnerability to Launch Modular Spy Campaign on Ukrainian Targets. Cites a CVE in CISA KEV.
  • Tue 9 Jun, 16:10 UTC. Dark Reading. Russian Attackers Weaponize WinRAR Flaw Against Ukrainian Orgs. Cites a CVE in CISA KEV.
  • Wed 10 Jun, 14:51 UTC. Security Affairs. Russian APTs exploit WinRAR flaw CVE-2025-8088 to target Ukraine. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 02:08 UTC. SecurityOnline. WinRAR Flaw CVE-2025-8088 Hits Ukrainian Firms Despite Patch. Cites a CVE in CISA KEV.
  • Tue 30 Jun, 08:21 UTC. SecurityOnline. STOCKSTAY malware hits Ukraine, Italy via phishing RDP exploits. Cites a CVE in CISA KEV.
  • Thu 15 Oct, 16:27 UTC. The Hacker News. Silent Lynx Exploits WinRAR Flaw in Attacks on CIS Governments. Cites a CVE in CISA KEV.
  • Thu 15 Oct, 20:01 UTC. Security Affairs. Kazakhstan Based Espionage Group Exploits CVE to Target Energy and Government. Cites a CVE in CISA KEV.
  • Fri 16 Oct, 09:08 UTC. SecurityOnline. Espionage Group Exploits WinRAR Flaw to Target CIS Governments. Cites a CVE in CISA KEV.
  • Tue 3 Nov, 16:00 UTC. Infosecurity. ESET says Gorbag targets Ukrainian officials with spyware. Cites a CVE in CISA KEV. This article, 23rd of 23.

ESET says the Russia-aligned cyberespionage group it calls Gorbag has targeted Ukrainian justice, law enforcement, local government and defence organisations since at least February 2025. The firm found victims only in Ukraine, many near the Russian border. About a quarter were justice or law-enforcement bodies and another quarter local administrations, mainly city councils near the front line.

Other targets included defence entities and an organisation publicly identified as a major transport hub for foreign military aid. ESET said the target choices align with Russia’s wartime intelligence priorities, including possible interest in war-crimes prosecutions, air-strike damage and military supplies.

Gorbag initially used spear-phishing emails themed around fines and taxes, including one sent from a compromised local-government account. In early 2026, it switched to RAR archives exploiting CVE-2025-8088, a WinRAR path traversal flaw. The archives displayed a decoy PDF while placing a shortcut in the Windows Startup folder and an encrypted payload and PowerShell loader in ProgramData. ESET says the loader ran at each system startup.

The custom infostealer, BeautyStealer, collected browser cookies, saved passwords and other data from Chrome, Edge, Opera and Firefox, as well as OpenVPN configurations and documents from user folders, removable media and mapped network drives. These included files containing electronic signature keys issued by a Ukrainian certification centre.

BeautyStealer deleted itself after sending stolen data to Telegram or a custom server. ESET says the tool was designed for one-time collection rather than long-term access. The firm suggested Gorbag may pass credentials to other threat actors as an initial access broker, but said it had not observed any follow-on activity.

How the story developed

All 23 articles
Developinglatest 1 hour ago23 articles9 outlets

23 articles from 9 outlets since 28 Jan. Picked up again today after 3 weeks quiet. This was the 23rd report, 279 days after the first.

Now28 Jan1625630 May1423213 OctFirst reportSecurityWeek · 28 Jan, 09:45This article23rd of 23 · day 279
  • Wed 28 Jan, 09:45 UTC. SecurityWeek, first report. APTs, Cybercriminals Widely Exploiting WinRAR Vulnerability. Cites a CVE in CISA KEV.
  • Wed 28 Jan, 10:50 UTC. The Hacker News, its first report on the story. Google Warns of Active Exploitation of WinRAR Vulnerability CVE-2025-8088. Cites a CVE in CISA KEV.
  • Wed 28 Jan, 23:36 UTC. Dark Reading, its first report on the story. Months After Patch, WinRAR Bug Poised to Hit SMBs Hardest. Cites a CVE in CISA KEV.
  • Thu 29 Jan, 02:55 UTC. SecurityOnline, its first report on the story. The “Zeroplayer” Arsenal: WinRAR Flaw CVE-2025-8088 Weaponized by Spies. Cites a CVE in CISA KEV.
  • Thu 29 Jan, 11:40 UTC. Security Affairs, its first report on the story. Nation-state and criminal actors leverage WinRAR flaw in attacks. Cites a CVE in CISA KEV.
  • Wed 4 Feb, 14:05 UTC. Check Point, its first report on the story. Amaranth-Dragon: Weaponizing CVE-2025-8088 for Targeted Espionage in the Southeast Asia. Cites a CVE in CISA KEV.
  • Wed 4 Feb, 15:10 UTC. The Hacker News. China-Linked Amaranth-Dragon Exploits WinRAR Flaw in Espionage Campaigns. Cites a CVE in CISA KEV.
  • Thu 5 Feb, 03:26 UTC. SecurityOnline. 10 Days to Exploit: Amaranth-Dragon Weaponizes WinRAR Flaw to Spy on SE Asia. Cites a CVE in CISA KEV.
  • Thu 5 Feb, 10:50 UTC. Security Affairs. China-linked Amaranth-Dragon hackers target Southeast Asian governments in 2025. Cites a CVE in CISA KEV.
  • Sun 8 Feb, 14:25 UTC. Security Affairs. SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 83. Cites a CVE in CISA KEV.
  • Wed 25 Feb, 16:01 UTC. Google Cloud, its first report on the story. Google: WinRAR CVE-2025-8088 abused by state actors to persist. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 16:32 UTC. The Hacker News. Kali Linux integrates Anthropic Claude AI to speed cyber attacks. Cites a CVE in CISA KEV.
  • Fri 6 Mar, 10:27 UTC. Securelist, its first report on the story. Q4 2025 Exploits Hit Windows and Linux, Spotlight CVE-2025-55182. Cites a CVE in CISA KEV.
  • Mon 1 Jun, 11:21 UTC. Infosecurity, its first report on the story. Ukrainian networks hit by stealth Gamaredon worm via WinRAR flaw. Cites a CVE in CISA KEV.
  • Thu 4 Jun, 11:41 UTC. Security Affairs. Gamaredon Uses WinRAR Vulnerability to Launch Modular Spy Campaign on Ukrainian Targets. Cites a CVE in CISA KEV.
  • Tue 9 Jun, 16:10 UTC. Dark Reading. Russian Attackers Weaponize WinRAR Flaw Against Ukrainian Orgs. Cites a CVE in CISA KEV.
  • Wed 10 Jun, 14:51 UTC. Security Affairs. Russian APTs exploit WinRAR flaw CVE-2025-8088 to target Ukraine. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 02:08 UTC. SecurityOnline. WinRAR Flaw CVE-2025-8088 Hits Ukrainian Firms Despite Patch. Cites a CVE in CISA KEV.
  • Tue 30 Jun, 08:21 UTC. SecurityOnline. STOCKSTAY malware hits Ukraine, Italy via phishing RDP exploits. Cites a CVE in CISA KEV.
  • Thu 15 Oct, 16:27 UTC. The Hacker News. Silent Lynx Exploits WinRAR Flaw in Attacks on CIS Governments. Cites a CVE in CISA KEV.
  • Thu 15 Oct, 20:01 UTC. Security Affairs. Kazakhstan Based Espionage Group Exploits CVE to Target Energy and Government. Cites a CVE in CISA KEV.
  • Fri 16 Oct, 09:08 UTC. SecurityOnline. Espionage Group Exploits WinRAR Flaw to Target CIS Governments. Cites a CVE in CISA KEV.
  • Tue 3 Nov, 16:00 UTC. Infosecurity. ESET says Gorbag targets Ukrainian officials with spyware. Cites a CVE in CISA KEV. This article, 23rd of 23.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 23 articles as a list
  1. Wed 28 JanDay 03
    1. APTs, Cybercriminals Widely Exploiting WinRAR Vulnerability09:45 · SecurityWeek · First report · Exploited CVE · Known exploited CVE
    2. Google Warns of Active Exploitation of WinRAR Vulnerability CVE-2025-808810:50 · The Hacker News · Known exploited CVE
    3. Months After Patch, WinRAR Bug Poised to Hit SMBs Hardest23:36 · Dark Reading · Known exploited CVE
  2. Thu 29 JanDay 12
    1. The “Zeroplayer” Arsenal: WinRAR Flaw CVE-2025-8088 Weaponized by Spies02:55 · SecurityOnline · Known exploited CVE
    2. Nation-state and criminal actors leverage WinRAR flaw in attacks11:40 · Security Affairs · Known exploited CVE

  3. Quiet for 6 days

    Wed 4 FebDay 72
    1. Amaranth-Dragon: Weaponizing CVE-2025-8088 for Targeted Espionage in the Southeast Asia14:05 · Check Point · Picked up again · Known exploited CVE
    2. China-Linked Amaranth-Dragon Exploits WinRAR Flaw in Espionage Campaigns15:10 · The Hacker News · Known exploited CVE
  4. Thu 5 FebDay 82
    1. 10 Days to Exploit: Amaranth-Dragon Weaponizes WinRAR Flaw to Spy on SE Asia03:26 · SecurityOnline · Known exploited CVE
    2. China-linked Amaranth-Dragon hackers target Southeast Asian governments in 202510:50 · Security Affairs · Known exploited CVE

  5. Quiet for 3 days

    Sun 8 FebDay 111
    1. SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 8314:25 · Security Affairs · Picked up again · Known exploited CVE

  6. Quiet for 2 weeks

    Wed 25 FebDay 281
    1. Google: WinRAR CVE-2025-8088 abused by state actors to persist16:01 · Google Cloud · Picked up again · Known exploited CVE
  7. Thu 26 FebDay 291
    1. Kali Linux integrates Anthropic Claude AI to speed cyber attacks16:32 · The Hacker News · Known exploited CVE

  8. Quiet for 8 days

    Fri 6 MarDay 371
    1. Q4 2025 Exploits Hit Windows and Linux, Spotlight CVE-2025-5518210:27 · Securelist · Picked up again · Known exploited CVE

  9. Quiet for 12 weeks

    Mon 1 JunDay 1241
    1. Ukrainian networks hit by stealth Gamaredon worm via WinRAR flaw11:21 · Infosecurity · Picked up again · Known exploited CVE

  10. Quiet for 3 days

    Thu 4 JunDay 1271
    1. Gamaredon Uses WinRAR Vulnerability to Launch Modular Spy Campaign on Ukrainian Targets11:41 · Security Affairs · Picked up again · Known exploited CVE

  11. Quiet for 5 days

    Tue 9 JunDay 1321
    1. Russian Attackers Weaponize WinRAR Flaw Against Ukrainian Orgs16:10 · Dark Reading · Picked up again · Known exploited CVE
  12. Wed 10 JunDay 1331
    1. Russian APTs exploit WinRAR flaw CVE-2025-8088 to target Ukraine14:51 · Security Affairs · Known exploited CVE

  13. Quiet for 4 days

    Mon 15 JunDay 1381
    1. WinRAR Flaw CVE-2025-8088 Hits Ukrainian Firms Despite Patch02:08 · SecurityOnline · Picked up again · Known exploited CVE

  14. Quiet for 2 weeks

    Tue 30 JunDay 1531
    1. STOCKSTAY malware hits Ukraine, Italy via phishing RDP exploits08:21 · SecurityOnline · Picked up again · Known exploited CVE

  15. Quiet for 15 weeks

    Thu 15 OctDay 2602
    1. Silent Lynx Exploits WinRAR Flaw in Attacks on CIS Governments16:27 · The Hacker News · Picked up again · Known exploited CVE
    2. Kazakhstan Based Espionage Group Exploits CVE to Target Energy and Government20:01 · Security Affairs · Known exploited CVE
  16. Fri 16 OctDay 2611
    1. Espionage Group Exploits WinRAR Flaw to Target CIS Governments09:08 · SecurityOnline · Known exploited CVE

  17. Quiet for 3 weeks

    Tue 3 NovDay 2791
    1. ESET says Gorbag targets Ukrainian officials with spyware16:00 · Infosecurity · Picked up again · Known exploited CVE · This article, 23rd of 23

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in