# Gorbag APT group hits Ukrainian courts and city councils with self-deleting malware (BeautyStealer, Prime ReverseShell) and CVE-2025-8088 WinRAR lures

> Russia-aligned group Gorbag, tracked by ESET and active since at least February 2025, runs highly targeted espionage against Ukrainian courts and justice bodies, frontline city councils, defense-sector entities and a transportation hub for foreign military aid. It delivers the BeautyStealer C++ stealer and Prime ReverseShell through macro-enabled Excel attachments and, from early 2026, RAR archives exploiting CVE-2025-8088; the malware self-deletes after exfiltration.

- **Published:** 2026-11-03T10:25:02Z
- **Last reviewed:** 2026-11-03T10:25:02Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5141
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5141.png
- **ID:** TL-2026-5141
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Gorbag (Russia)
- **Detections:** 9 (1 shown free below) · **IOCs:** 12
- **CVEs:** CVE-2025-8088

## Description

Gorbag is a Russia-aligned cyber-espionage group documented by ESET researcher Damien Schaeffer (presented at VB2026 as 'Gorbag: Orcs at the border'; ESET press release and Help Net Security coverage on 2026-11-03). ESET has tracked its activity since at least February 2025. Targeting is narrow and aligned with Russian strategic priorities: Ukrainian courts and justice bodies (roughly a quarter of victims), local administrations and city councils near the front line (roughly another quarter), defense-sector entities (including drone-related organizations) and a major transportation hub for foreign military aid. ESET notes that nearly every city whose council was targeted has since been subjected to Russian air strikes, and that the group appears interested in monitoring war-crime investigations. ESET assesses the operation may also function as an initial access broker.

Initial access is spearphishing, reportedly sent from compromised legitimate accounts, with lures themed around administrative fines, tax notices, military conscription, administrative processes and drone procurement. Throughout 2025 the attachment was a macro-enabled Excel workbook: a short VBA routine decodes a base64 payload stored in spreadsheet cells, drops it into %ProgramData% and runs it. From early 2026 the group switched to RAR archives crafted to exploit CVE-2025-8088, a WinRAR path-traversal flaw (CWE-35; NVD CVSS v3.1 8.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; fixed in WinRAR 7.13, added to CISA KEV on 2025-08-12) in which data hidden in NTFS alternate data streams is written outside the folder chosen by the user. When the victim opens the archive, a decoy PDF is displayed while a LNK file is written to the Windows Startup folder and an encrypted payload plus a PowerShell loader are written to %ProgramData%. The LNK provides persistence and launches the loader at every restart.

The main collection tool is BeautyStealer, a C++ stealer that ESET tracked across versions 0.9 to 2.0. It extracts cookies, saved passwords and Local State from Chrome, Edge, Opera and Firefox, harvests OpenVPN configurations, and collects roughly 40 file extensions, including .kdbx (KeePass), .jks (Java KeyStore), .rdp, .pfx and .zs2 (the format used for secret electronic signature keys issued by Ukrainian accredited key certification centers). It searches Desktop, Documents and Downloads folders, removable media and mapped network drives. Before BeautyStealer, Gorbag used Prime ReverseShell, a PowerShell reverse shell wrapped in a .NET binary and taken from a public GitHub repository. The malware deletes itself after exfiltration, limiting forensic artifacts.

No file hashes, C2 domains or IP addresses were published in the available sources, so no network IOCs are recorded and BeaconBeagle correlation was not applicable. The IOCs below are behavioral, file-system and tool indicators drawn from the reporting. Defenders should hunt for WinRAR/UnRAR versions at or below 7.12 writing LNK files to the Startup folder, Office-spawned script/PowerShell activity writing to %ProgramData%, and unusual bulk access to browser credential stores and signing-key files.

## MITRE ATT&CK

- T1586.002 Email Accounts
- T1588.002 Tool
- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1059.005 Visual Basic
- T1059.001 PowerShell
- T1203 Exploitation for Client Execution
- T1547.001 Registry Run Keys / Startup Folder
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1070.004 File Deletion
- T1555.003 Credentials from Web Browsers
- T1552.004 Private Keys
- T1005 Data from Local System
- T1025 Data from Removable Media
- T1039 Data from Network Shared Drive

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Gorbag CVE-2025-8088 WinRAR Archiver Writes LNK to Startup Folder (Exploitation)** (`TL-2026-5141-SPL-001`)

Behaviour-first detection of CVE-2025-8088 exploitation in the Gorbag (TL-2026-5141) RAR chain: WinRAR/RAR/UnRAR writing a LNK into the Windows Startup folder via NTFS ADS path traversal while a decoy PDF is shown. The LNK later launches a PowerShell loader at every logon.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1203, T1547.001, T1566.001, T1204.002
- **Data sources:** sysmon, windows_security
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 earliest=-24h
    (Image="*\\WinRAR.exe" OR Image="*\\Rar.exe" OR Image="*\\UnRAR.exe" OR Image="*\\UnRAR64.exe")
    TargetFilename="*\\Start Menu\\Programs\\Startup\\*.lnk"
```CVE-2025-8088 (WinRAR <= 7.12): NTFS ADS path traversal makes the archiver write a LNK into the Startup folder, outside the user-chosen extraction folder. Gorbag TL-2026-5141 RAR chain```
| stats count min(_time) as first_seen max(_time) as last_seen values(Image) as archiver values(TargetFilename) as startup_lnk values(ProcessGuid) as process_guid by host, User
| convert ctime(first_seen) ctime(last_seen)
| table host User archiver startup_lnk count first_seen last_seen process_guid
````

### Microsoft KQL

```kql
DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| where InitiatingProcessFileName in~ ("WinRAR.exe", "Rar.exe", "UnRAR.exe", "UnRAR64.exe")
| where FolderPath has @"\Start Menu\Programs\Startup\" and FileName endswith ".lnk"
| project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessVersionInfoProductVersion, SHA256
| order by Timestamp desc
```

### Sigma

```yaml
title: WinRAR CVE-2025-8088 Archiver Writes LNK To Startup Folder
id: 5b0c2f4e-8d1a-4c6e-9a31-7e2f0d5c1a01
status: experimental
description: Detects WinRAR/RAR/UnRAR writing a .lnk file into a user or all-users Startup folder, the persistence artefact of CVE-2025-8088 path-traversal exploitation used by Gorbag (TL-2026-5141).
references:
  - https://www.helpnetsecurity.com/2026/11/03/gorbag-apt-group-malware/
  - https://www.virusbulletin.com/conference/vb2026/abstracts/gorbag-orcs-border/
  - https://nvd.nist.gov/vuln/detail/CVE-2025-8088
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-03
tags:
  - attack.initial_access
  - attack.t1566.001
  - attack.execution
  - attack.t1203
  - attack.persistence
  - attack.t1547.001
  - cve.2025.8088
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
      - '\WinRAR.exe'
      - '\Rar.exe'
      - '\UnRAR.exe'
      - '\UnRAR64.exe'
    TargetFilename|contains: '\Start Menu\Programs\Startup\'
    TargetFilename|endswith: '.lnk'
  condition: selection
falsepositives:
  - Users who intentionally extract an archive containing shortcuts into the Startup folder
  - Software deployment packages distributed as RAR that install Startup shortcuts
level: high

```

**Known false positives:**

- Users intentionally extracting archives that contain shortcuts into the Startup folder
- Software packages shipped as RAR that install Startup shortcuts

**Tuning notes:** Baseline legitimate RAR-delivered Startup shortcuts and exclude by archive/LNK name. Also hunt for UnRAR.dll-hosting processes (dtSearch, file managers) by dropping the Image filter and keying on the Startup LNK path alone. Requires Sysmon EID 11 with the Startup path not excluded in the config.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Gorbag Excel Macro Decodes And Executes Payload From ProgramData (Exploitation) (locked: unlock with TL Creds)
- Gorbag Self-Deleting Executable in ProgramData After Execution (Post-Exploitation) (locked: unlock with TL Creds)
- Gorbag Prime ReverseShell PowerShell With Outbound Connection (C2) (locked: unlock with TL Creds)
- Gorbag CVE-2025-8088 Archiver Drops Loader And Payload in ProgramData (Exploitation) (locked: unlock with TL Creds)
- Gorbag Excel Macro Spawns Script Interpreter or ProgramData Payload (Post-Exploitation) (locked: unlock with TL Creds)
- Gorbag BeautyStealer Staging of Key, Vault and RDP Files From ProgramData (Collection) (locked: unlock with TL Creds)
- Gorbag PowerShell Loader Reads Encrypted Payload From ProgramData (Post-Exploitation) (locked: unlock with TL Creds)
- Gorbag BeautyStealer Bulk Access to Browser Credential Stores and Signing Keys (Collection) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Gorbag APT group hits Ukrainian courts and city councils with self-deleting malware](https://www.helpnetsecurity.com/2026/11/03/gorbag-apt-group-malware/)
- [Gorbag: Orcs at the border (VB2026 abstract, Damien Schaeffer, ESET)](https://www.virusbulletin.com/conference/vb2026/abstracts/gorbag-orcs-border/)
- [ESET Research uncovers Gorbag, Russia-aligned threat group harvesting intelligence from Ukraine](https://www.globenewswire.com/news-release/2026/11/03/3393967/0/en/eset-research-uncovers-gorbag-russia-aligned-threat-group-harvesting-intelligence-from-ukraine.html)
- [Update WinRAR tools now: RomCom and others exploiting zero-day vulnerability (ESET)](https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/)
- [WinRAR Zero-Day Under Active Exploitation (The Hacker News)](https://thehackernews.com/2025/08/winrar-zero-day-under-active.html)
- [NVD - CVE-2025-8088](https://nvd.nist.gov/vuln/detail/CVE-2025-8088)
- [CISA Known Exploited Vulnerabilities Catalog - RARLAB WinRAR Path Traversal Vulnerability (CVE-2025-8088)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [CVE-2025-8088 Technical Analysis: WinRAR Arbitrary File Write Through ADS (OPSWAT)](https://www.opswat.com/blog/cve-2025-8088-technical-analysis-winrar-arbitrary-file-write-through-ads)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5141