Skip to navigation

Threat reportAPTTL-2026-5198

Gorbag: Russia-aligned espionage group targets Ukrainian war crimes investigations and military aid routes (BeautyStealer, Prime ReverseShell, CVE-2025-8088)

highACTIVE

Gorbag is a Russia-aligned espionage group, identified by ESET and active since at least February 2025, that targets Ukrainian judicial, law enforcement, defense and front-line local government bodies and a foreign military aid transportation hub. It uses spearphishing with macro-enabled Excel files and, since early 2026, WinRAR CVE-2025-8088 archives to deploy the BeautyStealer infostealer, after earlier use of the Prime ReverseShell, for rapid one-shot data harvesting.

Key facts for Gorbag espionage group

IdentifiersTL-2026-5198, CVE-2025-8088
SeverityHIGH
CVSS8.8
First disclosed
Exploitation statusExploited in the wild; Listed in CISA KEV: CVE-2025-8088 (added )
EPSSCVE-2025-8088: 94.2% (99.8th percentile)
Affected productsRARLAB WinRAR for Windows; Ukrainian public sector Government, judicial, law enforcement, local administration and defense-sector organizations (Windows endpoints)
Weaknesses (CWE)CWE-35
AttributionGorbag (medium confidence)
Nation-state nexusRussia
MalwareBeautyStealer, Prime ReverseShell, Ps2exe
ToolsFastAPI-based custom C2 server, PS2EXE, PSSW100AVB
MITRE ATT&CK techniquesT1005 Data from Local System, T1027.009 Obfuscated Files or Information: Embedded Payloads, T1059.001 Command and Scripting Interpreter: PowerShell, T1059.005 Command and Scripting Interpreter: Visual Basic, T1070.004 Indicator Removal: File Deletion, T1071.001 Application Layer Protocol: Web Protocols, T1199 Trusted Relationship, T1203 Exploitation for Client Execution, T1204.002 User Execution: Malicious File, T1217 Browser Information Discovery, T1539 Steal Web Session Cookie, T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder and 12 more in the attack flow
MotivationESPIONAGE
Target sectorsgovernment administration, police - law enforcement, judiciary, defense, logistics, local government
Target regionsukraine
Detection rules9 (1 shown free)
Sources10 cited sources

Detection coverage for Gorbag espionage group

As of 2026-11-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5198 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Gorbag CVE-2025-8088 WinRAR Path-Traversal Drop to Startup/ProgramData

Detects WinRAR/UnRAR writing an LNK into the user Startup folder or a loader/payload (.ps1, .lnk, .exe, .dll, .dat) into ProgramData, the on-disk signature of the CVE-2025-8088 alternate-data-stream path traversal used by Gorbag since early 2026 to stage a PowerShell loader that deploys BeautyStealer. Legitimate archive extraction rarely lands files in the Startup folder, so this is a behaviour-first exploit-trigger detection.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1203, T1547.001, T1204.002, T1027.009
  • Data sources: sysmon, microsoft_defender_for_endpoint
  • Severity: high
  • Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 (Image="*WinRAR.exe" OR Image="*UnRAR.exe" OR Image="*Rar.exe") (TargetFilename="*Start Menu*Programs*Startup*.lnk" OR TargetFilename="*ProgramData*.ps1" OR TargetFilename="*ProgramData*.lnk" OR TargetFilename="*ProgramData*.exe" OR TargetFilename="*ProgramData*.dll" OR TargetFilename="*ProgramData*.dat") | stats count min(_time) as first_seen max(_time) as last_seen values(TargetFilename) as dropped_files by host, User, Image | convert ctime(first_seen) ctime(last_seen) | eval threat="TL-2026-5198 Gorbag CVE-2025-8088 WinRAR path traversal"

Microsoft KQL

DeviceFileEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("WinRAR.exe", "UnRAR.exe", "Rar.exe")
| where (FolderPath has "Start Menu" and FolderPath has "Startup" and FileName endswith ".lnk")
    or (FolderPath has "ProgramData" and (FileName endswith ".ps1" or FileName endswith ".lnk" or FileName endswith ".exe" or FileName endswith ".dll" or FileName endswith ".dat"))
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, FileName, SHA1

Sigma

title: Gorbag CVE-2025-8088 WinRAR Path Traversal Drop to Startup or ProgramData
id: 3f6c1d52-8a41-4b7e-9c2a-5d1e7b9a0c11
status: experimental
description: Detects WinRAR or UnRAR writing an LNK to the Startup folder or a loader and payload to ProgramData, consistent with exploitation of CVE-2025-8088 by Gorbag to stage a PowerShell loader for BeautyStealer.
references:
    - https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/
    - https://nvd.nist.gov/vuln/detail/CVE-2025-8088
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-04
tags:
    - attack.execution
    - attack.t1203
    - attack.persistence
    - attack.t1547.001
    - attack.t1204.002
    - cve.2025.8088
logsource:
    category: file_event
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\WinRAR.exe'
            - '\UnRAR.exe'
            - '\Rar.exe'
    selection_startup:
        TargetFilename|contains: '\Start Menu\Programs\Startup\'
        TargetFilename|endswith: '.lnk'
    selection_programdata:
        TargetFilename|startswith: 'C:\ProgramData\'
        TargetFilename|endswith:
            - '.ps1'
            - '.lnk'
            - '.exe'
            - '.dll'
            - '.dat'
    condition: selection_img and (selection_startup or selection_programdata)
falsepositives:
    - Legitimate extraction of installers or admin tooling into ProgramData with WinRAR
    - Administrators distributing Startup shortcuts inside archives
level: high

Known false positives:

  • Legitimate extraction of installers or admin tooling into C:\ProgramData with WinRAR
  • Administrators distributing Startup shortcuts inside archives

Tuning notes: Requires Sysmon EventID 11 (FileCreate) with WinRAR/UnRAR in scope. Allow-list known software-deployment accounts and extraction paths, and consider raising to critical when the WinRAR build is 7.12 or earlier (fixed in 7.13).

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Gorbag Macro-Enabled Excel Dropper — ProgramData Payload Written then Executed · unlock with TL Creds
  • Gorbag Prime ReverseShell — PS2EXE .NET Binary Hosting PowerShell Engine · unlock with TL Creds
  • Gorbag BeautyStealer Telegram Bot API Exfiltration by Non-Browser Process · unlock with TL Creds
  • Gorbag Lure Filenames and Published Malware Hashes · unlock with TL Creds
  • Gorbag BeautyStealer Browser Credential and Cookie Store Access by Non-Browser Process · unlock with TL Creds
  • Gorbag BeautyStealer Self-Deletion Command After Exfiltration · unlock with TL Creds
  • Gorbag Startup LNK Launching PowerShell Loader from ProgramData at Logon · unlock with TL Creds
  • Gorbag Network Connections to Known Prime ReverseShell C2 and BeautyStealer Exfil IPs · unlock with TL Creds

Indicators of compromise for Gorbag espionage group

As of 2026-11-04, Threadlinqs Intelligence tracks 22 indicators of compromise for TL-2026-5198.

Sample indicators (3 of 22)

  • IP address: 89.44.9[.]186
  • File hash: C17369B4B49113D07F080DF832E218156FB0940F
  • IP address: 142.111.194[.]73

Defanged, TLP:CLEAR. Full set of 22 indicators: unlock with TL Creds.

22 indicators of compromise · unlock with TL Creds. Compare plans

How Gorbag espionage group works

ESET Research identified Gorbag as a previously unreported Russia-aligned threat actor active since at least February 2025. All confirmed targets are in Ukraine, many close to the front line or the Russian border. Roughly 25% of known targets are law enforcement and justice bodies (including judicial entities tied to war-crimes proceedings), roughly 25% are local administrations such as city councils, and the remainder are defense-sector entities (including drone-related organizations) and a major transportation hub for foreign military assistance. The targeting is consistent with Russian intelligence priorities: monitoring war-crimes investigations, assessing damage from Russian strikes, tracking local defense initiatives and military supply routes. The research was presented by ESET at Virus Bulletin 2026.

In 2025 the group gained initial access through spearphishing emails, often sent from compromised legitimate Ukrainian local government mailboxes, carrying .xlsm attachments with lures about administrative fines, tax notices and official correspondence. A VBA macro decoded a base64-encoded payload held in spreadsheet cells, dropped it to %ProgramData% and executed it. In early 2026 the group switched to RAR archives exploiting CVE-2025-8088, a WinRAR path traversal flaw (versions through 7.12, fixed in 7.13) abused through NTFS alternate data streams so that content is extracted outside the folder the user selected. The archive shows a decoy PDF while placing an encrypted payload and a PowerShell loader in %ProgramData% and an LNK file in the Windows Startup folder, which launches the loader at the next logon. CVE-2025-8088 was reported by ESET and was earlier exploited as a zero-day by RomCom; it was added to CISA KEV on 2025-08-12.

The toolset is small. Prime ReverseShell is a PowerShell reverse shell derived from the public PSSW100AVB GitHub project, compiled to a .NET executable with PS2EXE and used before BeautyStealer. One variant embedded a comment addressed to LLMs/AI analysis tools claiming the file is a harmless prime-number generator; ESET found it ineffective. BeautyStealer is a C++ infostealer (versions 0.9, 1.1, 1.2, 2.0) that collects cookies, saved passwords and local state from Chrome, Edge, Opera and Firefox, OpenVPN configurations from user and system directories, and files from Desktop, Documents and Downloads, removable media and mapped network drives. It targets roughly 40 extensions including Office documents, archives, email (.eml), KeePass (.kdbx), Java keystores (.jks), RDP (.rdp), PFX (.pfx), OpenVPN (.ovpn) and Ukrainian electronic signature key files (.zs2). Early versions (0.9-1.1) exfiltrated through the Telegram API (sendDocument); from v1.2 a custom FastAPI-based C2 server is used. Encoding progressed from Base64 to XOR (v1.2) to RC4 (v2.0). The stealer deletes itself after exfiltration (BAT scripts in earlier versions, Windows API calls later).

ESET assesses the operation as prioritizing rapid collection over long-term persistence and suggests Gorbag may act as an access/credential broker passing stolen data to other actors, though follow-on activity is unconfirmed. Attribution is to a Russia-aligned actor based on targeting; no state sponsor or link to a known group has been established.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1560 Archive Collected Data; T1560.001 Archive Collected Data: Archive via Utility

Defense Evasion

T1027.009 Obfuscated Files or Information: Embedded Payloads; T1070.004 Indicator Removal: File Deletion; T1564.004 Hide Artifacts: NTFS File Attributes

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1059.005 Command and Scripting Interpreter: Visual Basic; T1203 Exploitation for Client Execution; T1204.002 User Execution: Malicious File

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1573.001 Encrypted Channel: Symmetric Cryptography

Initial Access

T1199 Trusted Relationship; T1566.001 Phishing: Spearphishing Attachment

Discovery

T1217 Browser Information Discovery

Credential Access

T1539 Steal Web Session Cookie; T1555.003 Credentials from Password Stores: Credentials from Web Browsers

Persistence

T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Exfiltration

T1567 Exfiltration Over Web Service

Resource Development

T1583 Acquire Infrastructure; T1586.002 Compromise Accounts: Email Accounts; T1587.001 Develop Capabilities: Malware; T1588.001 Obtain Capabilities: Malware; T1588.005 Obtain Capabilities: Exploits

Remediation for Gorbag espionage group

Patches

  • Update WinRAR to 7.13 or later to remediate CVE-2025-8088

Immediate actions

  • Block and hunt for 89.44.9.186 and 142.111.194.73 in proxy, firewall and DNS logs
  • Search endpoints for the published SHA-1 hashes and for files named 'Windows Telemetry', 'додаток податкова.xlsm' and 'Повідомлення 4726-49.rar'
  • Hunt for unexpected LNK files in Startup folders and PowerShell loaders or encrypted payloads in %ProgramData%
  • Reset browser-saved passwords, invalidate sessions and rotate VPN credentials and certificates on any suspected host
  • Revoke and reissue electronic signature keys (.zs2), PFX certificates and KeePass-stored secrets that may have been exposed

Workarounds

  • Avoid opening RAR archives from unverified senders until WinRAR is patched; use a tool not affected by the flaw
  • Disable macro execution for Office files received from email

Longer-term hardening

  • Block VBA macros from internet-origin Office files via policy
  • Restrict outbound access to the Telegram API from servers and workstations where it is not required
  • Alert on PS2EXE-compiled .NET binaries and PowerShell launched from LNK files or from %ProgramData%
  • Stop storing credentials and VPN configurations in browsers; use managed vaults with MFA
  • Train staff on lures sent from compromised legitimate government mailboxes (fines, tax, conscription, drone procurement)

Affected and fixed versions

  • RARLAB — WinRAR for Windows
    Vulnerable versions: through 7.12
    Fixed in: 7.13
  • Ukrainian public sector — Government, judicial, law enforcement, local administration and defense-sector organizations (Windows endpoints)

Timeline of Gorbag espionage group

Last updated · 2 updates · revalidated 2× · latest source

  • Gorbag activity begins; ESET tracks the group as active since at least February 2025 against Ukrainian targets (month-level date).
  • ESET first observes locked-ioc-17 (M247 Europe SRL) used as C&C for locked-ioc-12.
  • CERT-UA publishes CERT-UA#14303 on locked-ioc-21 using malicious Excel macros to deploy the locked-ioc-18 stealer against Ukrainian institutions; ESET later links this tooling to Gorbag.
  • ESET discovers in-the-wild exploitation of WinRAR CVE-2025-8088 by RomCom (zero-day at the time); Gorbag's later use is n-day adoption.
  • WinRAR 7.13 released, fixing the CVE-2025-8088 path traversal flaw (patched July 2025).
  • CVE-2025-8088 published in NVD (CVSS 3.1 8.8, CWE-35); affects WinRAR for Windows through 7.12.
  • CISA adds CVE-2025-8088 to the Known Exploited Vulnerabilities catalog.
  • In early 2026 Gorbag shifts from macro-enabled .xlsm lures to RAR archives exploiting CVE-2025-8088 with decoy PDFs and Startup-folder LNK persistence (approximate date).
  • ESET first observes locked-ioc-14 (EGIHosting) used as locked-ioc-15 exfiltration endpoint.
  • ESET presents 'Gorbag: Orcs at the border' at Virus Bulletin 2026.
  • ESET Research publicly discloses Gorbag; coverage published by The Record, Help Net Security and others, with research presented at Virus Bulletin 2026.

Update history

Sources cited for Gorbag espionage group

Drafted by the Threadlinqs research pipeline from 10 sources; published ; last updated .

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats