Gorbag APT group hits Ukrainian courts and city councils with self-deleting malware (BeautyStealer, Prime ReverseShell) and CVE-2025-8088 WinRAR lures

Key facts for Gorbag BeautyStealer campaign

Detection coverage for Gorbag BeautyStealer campaign

As of 2026-11-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5141 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Gorbag CVE-2025-8088 WinRAR Archiver Writes LNK to Startup Folder (Exploitation)

Behaviour-first detection of CVE-2025-8088 exploitation in the Gorbag (TL-2026-5141) RAR chain: WinRAR/RAR/UnRAR writing a LNK into the Windows Startup folder via NTFS ADS path traversal while a decoy PDF is shown. The LNK later launches a PowerShell loader at every logon.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1203, T1547.001, T1566.001, T1204.002
• Data sources: sysmon, windows_security
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 earliest=-24h
    (Image="*\\WinRAR.exe" OR Image="*\\Rar.exe" OR Image="*\\UnRAR.exe" OR Image="*\\UnRAR64.exe")
    TargetFilename="*\\Start Menu\\Programs\\Startup\\*.lnk"
```CVE-2025-8088 (WinRAR <= 7.12): NTFS ADS path traversal makes the archiver write a LNK into the Startup folder, outside the user-chosen extraction folder. Gorbag TL-2026-5141 RAR chain```
| stats count min(_time) as first_seen max(_time) as last_seen values(Image) as archiver values(TargetFilename) as startup_lnk values(ProcessGuid) as process_guid by host, User
| convert ctime(first_seen) ctime(last_seen)
| table host User archiver startup_lnk count first_seen last_seen process_guid

Microsoft KQL

DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| where InitiatingProcessFileName in~ ("WinRAR.exe", "Rar.exe", "UnRAR.exe", "UnRAR64.exe")
| where FolderPath has @"\Start Menu\Programs\Startup\" and FileName endswith ".lnk"
| project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessVersionInfoProductVersion, SHA256
| order by Timestamp desc

Sigma

title: WinRAR CVE-2025-8088 Archiver Writes LNK To Startup Folder
id: 5b0c2f4e-8d1a-4c6e-9a31-7e2f0d5c1a01
status: experimental
description: Detects WinRAR/RAR/UnRAR writing a .lnk file into a user or all-users Startup folder, the persistence artefact of CVE-2025-8088 path-traversal exploitation used by Gorbag (TL-2026-5141).
references:
  - https://www.helpnetsecurity.com/2026/11/03/gorbag-apt-group-malware/
  - https://www.virusbulletin.com/conference/vb2026/abstracts/gorbag-orcs-border/
  - https://nvd.nist.gov/vuln/detail/CVE-2025-8088
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-03
tags:
  - attack.initial_access
  - attack.t1566.001
  - attack.execution
  - attack.t1203
  - attack.persistence
  - attack.t1547.001
  - cve.2025.8088
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
      - '\WinRAR.exe'
      - '\Rar.exe'
      - '\UnRAR.exe'
      - '\UnRAR64.exe'
    TargetFilename|contains: '\Start Menu\Programs\Startup\'
    TargetFilename|endswith: '.lnk'
  condition: selection
falsepositives:
  - Users who intentionally extract an archive containing shortcuts into the Startup folder
  - Software deployment packages distributed as RAR that install Startup shortcuts
level: high

Known false positives:

• Users intentionally extracting archives that contain shortcuts into the Startup folder
• Software packages shipped as RAR that install Startup shortcuts

Tuning notes: Baseline legitimate RAR-delivered Startup shortcuts and exclude by archive/LNK name. Also hunt for UnRAR.dll-hosting processes (dtSearch, file managers) by dropping the Image filter and keying on the Startup LNK path alone. Requires Sysmon EID 11 with the Startup path not excluded in the config.

• 🔒 Gorbag Excel Macro Decodes And Executes Payload From ProgramData (Exploitation) · unlock with TL Creds
• 🔒 Gorbag Self-Deleting Executable in ProgramData After Execution (Post-Exploitation) · unlock with TL Creds
• 🔒 Gorbag Prime ReverseShell PowerShell With Outbound Connection (C2) · unlock with TL Creds
• 🔒 Gorbag CVE-2025-8088 Archiver Drops Loader And Payload in ProgramData (Exploitation) · unlock with TL Creds
• 🔒 Gorbag Excel Macro Spawns Script Interpreter or ProgramData Payload (Post-Exploitation) · unlock with TL Creds
• 🔒 Gorbag BeautyStealer Staging of Key, Vault and RDP Files From ProgramData (Collection) · unlock with TL Creds
• 🔒 Gorbag PowerShell Loader Reads Encrypted Payload From ProgramData (Post-Exploitation) · unlock with TL Creds
• 🔒 Gorbag BeautyStealer Bulk Access to Browser Credential Stores and Signing Keys (Collection) · unlock with TL Creds

Indicators of compromise for Gorbag BeautyStealer campaign

As of 2026-11-03, Threadlinqs Intelligence tracks 12 indicators of compromise for TL-2026-5141.

How Gorbag BeautyStealer campaign works

Gorbag is a Russia-aligned cyber-espionage group documented by ESET researcher Damien Schaeffer (presented at VB2026 as 'Gorbag: Orcs at the border'; ESET press release and Help Net Security coverage on 2026-11-03). ESET has tracked its activity since at least February 2025. Targeting is narrow and aligned with Russian strategic priorities: Ukrainian courts and justice bodies (roughly a quarter of victims), local administrations and city councils near the front line (roughly another quarter), defense-sector entities (including drone-related organizations) and a major transportation hub for foreign military aid. ESET notes that nearly every city whose council was targeted has since been subjected to Russian air strikes, and that the group appears interested in monitoring war-crime investigations. ESET assesses the operation may also function as an initial access broker.

Initial access is spearphishing, reportedly sent from compromised legitimate accounts, with lures themed around administrative fines, tax notices, military conscription, administrative processes and drone procurement. Throughout 2025 the attachment was a macro-enabled Excel workbook: a short VBA routine decodes a base64 payload stored in spreadsheet cells, drops it into %ProgramData% and runs it. From early 2026 the group switched to RAR archives crafted to exploit CVE-2025-8088, a WinRAR path-traversal flaw (CWE-35; NVD CVSS v3.1 8.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; fixed in WinRAR 7.13, added to CISA KEV on 2025-08-12) in which data hidden in NTFS alternate data streams is written outside the folder chosen by the user. When the victim opens the archive, a decoy PDF is displayed while a LNK file is written to the Windows Startup folder and an encrypted payload plus a PowerShell loader are written to %ProgramData%. The LNK provides persistence and launches the loader at every restart.

The main collection tool is BeautyStealer, a C++ stealer that ESET tracked across versions 0.9 to 2.0. It extracts cookies, saved passwords and Local State from Chrome, Edge, Opera and Firefox, harvests OpenVPN configurations, and collects roughly 40 file extensions, including .kdbx (KeePass), .jks (Java KeyStore), .rdp, .pfx and .zs2 (the format used for secret electronic signature keys issued by Ukrainian accredited key certification centers). It searches Desktop, Documents and Downloads folders, removable media and mapped network drives. Before BeautyStealer, Gorbag used Prime ReverseShell, a PowerShell reverse shell wrapped in a .NET binary and taken from a public GitHub repository. The malware deletes itself after exfiltration, limiting forensic artifacts.

No file hashes, C2 domains or IP addresses were published in the available sources, so no network IOCs are recorded and BeaconBeagle correlation was not applicable. The IOCs below are behavioral, file-system and tool indicators drawn from the reporting. Defenders should hunt for WinRAR/UnRAR versions at or below 7.12 writing LNK files to the Startup folder, Office-spawned script/PowerShell activity writing to %ProgramData%, and unusual bulk access to browser credential stores and signing-key files.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1025 Data from Removable Media; T1039 Data from Network Shared Drive

Defense Evasion

T1027 Obfuscated Files or Information; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information

Execution

T1059.001 PowerShell; T1059.005 Visual Basic; T1203 Exploitation for Client Execution; T1204.002 Malicious File

Persistence

T1547.001 Registry Run Keys / Startup Folder

Credential Access

T1552.004 Private Keys; T1555.003 Credentials from Web Browsers

Initial Access

T1566.001 Spearphishing Attachment

Resource Development

T1586.002 Email Accounts; T1588.002 Tool

Remediation for Gorbag BeautyStealer campaign

Patches

• WinRAR 7.13 (released 2025-07-30) fixes CVE-2025-8088

Immediate actions

• Update WinRAR and any UnRAR.dll-based software to 7.13 or later (CVE-2025-8088)
• Hunt for LNK files created in the Windows Startup folder by WinRAR/UnRAR processes and for unexpected executables or PowerShell loaders in %ProgramData%
• Block macro execution in Office files received from the internet and quarantine inbound RAR attachments for Ukrainian-government and defense-sector mailboxes
• Rotate browser-stored credentials, OpenVPN profiles and revoke/re-issue any qualified electronic signature keys (.zs2, .pfx) on hosts suspected of compromise

Workarounds

• Use only patched archivers; avoid opening unsolicited RAR archives
• Disable VBA macros via Group Policy and enforce Mark-of-the-Web blocking for macros

Longer-term hardening

• Deploy EDR with behavioral detection for Office/archiver child-process and persistence activity
• Store signing keys on hardware tokens instead of removable media or user directories
• Disable browser password storage and use a managed password vault with MFA
• Train staff in courts, local administrations and defense entities on lures themed around fines, tax notices, conscription and drone procurement, including mail from compromised partner accounts

Affected and fixed versions

• RARLAB — WinRAR (Windows), RAR, UnRAR, UnRAR.dll, portable UnRAR source
  Vulnerable versions: 7.12 and earlier
  Fixed in: 7.13
• dtSearch — dtSearch (Windows; bundles affected UnRAR code)
  Vulnerable versions: before 2023.01
  Fixed in: 2023.01
• Microsoft — Microsoft Excel (macro-enabled workbooks abused for initial execution)
  Vulnerable versions: Hosts allowing VBA macro execution

Timeline of Gorbag BeautyStealer campaign

• 2025-02-01 ESET tracks locked-ioc-8 activity against Ukrainian organizations since at least February 2025 (month-level date; exact day not stated).
• 2025-07-07 Actor 'zeroplayer' advertises a WinRAR exploit on the Exploit.in forum for $80,000 (later tied to the CVE-2025-8088 exploitation landscape).
• 2025-07-18 ESET discovers RomCom exploiting the WinRAR path-traversal zero-day CVE-2025-8088 in the wild.
• 2025-07-30 RARLAB releases WinRAR 7.13 fixing CVE-2025-8088.
• 2025-08-08 CVE-2025-8088 published in NVD (CVSS v3.1 8.8).
• 2025-08-12 CISA adds CVE-2025-8088 (RARLAB WinRAR Path Traversal) to the Known Exploited Vulnerabilities catalog.
• 2025-12-31 Throughout 2025 locked-ioc-8 spearphishes with macro-enabled Excel attachments whose VBA decodes a base64 payload from cells, drops it in locked-ioc-6 and runs it (period-level date: calendar year 2025).
• 2026-01-01 In early 2026 locked-ioc-8 switches to RAR archives exploiting CVE-2025-8088, displaying a decoy PDF while writing a Startup-folder LNK and an encrypted payload plus PowerShell loader to locked-ioc-6 (approximate date: 'early 2026').
• 2026-11-03 ESET publicly attributes the campaign to locked-ioc-8 (VB2026 talk 'locked-ioc-8: Orcs at the border', press release and Help Net Security coverage).

Sources cited for Gorbag BeautyStealer campaign

• NVD - CVE-2025-8088 NVD (NIST) · Advisory · 2025-08-08
• CISA Known Exploited Vulnerabilities Catalog - RARLAB WinRAR Path Traversal Vulnerability (CVE-2025-8088) CISA · Government advisory · 2025-08-12
• Gorbag: Orcs at the border (VB2026 abstract, Damien Schaeffer, ESET) virusbulletin.com · Research · 2026-11-03
• ESET Research uncovers Gorbag, Russia-aligned threat group harvesting intelligence from Ukraine globenewswire.com · Vendor report · 2026-11-03
• Update WinRAR tools now: RomCom and others exploiting zero-day vulnerability (ESET) ESET WeLiveSecurity · Vendor report · 2025-08-11
• CVE-2025-8088 Technical Analysis: WinRAR Arbitrary File Write Through ADS (OPSWAT) opswat.com · Blog
• Gorbag APT group hits Ukrainian courts and city councils with self-deleting malware Help Net Security · News · 2026-11-03
• WinRAR Zero-Day Under Active Exploitation (The Hacker News) The Hacker News · News · 2025-08-11

More in apt

• APT29 (Midnight Blizzard) watering holes target iOS and Android devices with n-day exploit chains (DarkSword, AndroSnitch)
• Gorbag: Russia-aligned espionage group targets Ukrainian war crimes investigations and military aid routes (BeautyStealer, Prime ReverseShell, CVE-2025-8088)
• ARTEX Agentic AI Penetration-Testing Framework Abused by China-Aligned Actors Storm-0940 and VAPOR PANDA to Automate Enterprise and Cloud Intrusions
• Kimsuky (APT43) Dot-Padded LNK Spear-Phishing Tradecraft: Detection and Exploitation Analysis
• TraderTraitor (North Korea) months-long campaign leads to $6.34B Binance cryptocurrency theft