Threat video1:00
Gorbag APT BeautyStealer & WinRAR Lures: Detection & IOCs
Gorbag hits Ukrainian courts with self-deleting BeautyStealer and CVE-2025-8088 lures: 9 detection rules, 12 IOCs and a free Splunk SPL rule.
Read the full threat intel for Gorbag APT BeautyStealer & WinRAR Lures: Detection & IOCs →
Chapters
- 0:00The hookGorbag targets four Ukrainian government sectors.
- 0:04The storyFrom February 2025, targeting courts.
- 0:11Attack pathReportedly from compromised email accounts.
- 0:27AttributionAttributed to Gorbag.
- 0:31Indicators of compromise2 indicators to hunt: 2 paths.
- 0:37MITRE ATT&CK techniques16 ATT&CK techniques, from resource development to collection.
- 0:41Remediation4 steps now: Update WinRAR and any UnRAR.dll-based software to 7.13 or later.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Gorbag targets four Ukrainian government sectors.
0:05From February 2025, targeting courts.
0:08By early 2026, switched to RAR.
0:12Reportedly from compromised email accounts.
0:14Spearphishing brings macro Excel or RAR archives.
0:18Prime ReverseShell, then BeautyStealer steals credentials and keys.
0:23Malware self-deletes after exfiltration.
0:28Attributed to Gorbag. Confidence: medium.
0:322 indicators to hunt: 2 paths.
0:3716 ATT&CK techniques, from resource development to collection.
0:424 steps now: Update WinRAR and any UnRAR.dll-based software to 7.13 or later.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.