# Gorbag: Russia-aligned espionage group targets Ukrainian war crimes investigations and military aid routes (BeautyStealer, Prime ReverseShell, CVE-2025-8088)

> Gorbag is a Russia-aligned espionage group, identified by ESET and active since at least February 2025, that targets Ukrainian judicial, law enforcement, defense and front-line local government bodies and a foreign military aid transportation hub. It uses spearphishing with macro-enabled Excel files and, since early 2026, WinRAR CVE-2025-8088 archives to deploy the BeautyStealer infostealer, after earlier use of the Prime ReverseShell, for rapid one-shot data harvesting.

- **Published:** 2026-11-04T02:01:21Z
- **Last reviewed:** 2026-11-04T18:56:44.135Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5198
- **ID:** TL-2026-5198
- **Severity:** HIGH (CVSS 8.8)
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Gorbag (Russia)
- **Detections:** 9 (1 shown free below) · **IOCs:** 22 (3 shown free below)
- **CVEs:** CVE-2025-8088

## Description

ESET Research identified Gorbag as a previously unreported Russia-aligned threat actor active since at least February 2025. All confirmed targets are in Ukraine, many close to the front line or the Russian border. Roughly 25% of known targets are law enforcement and justice bodies (including judicial entities tied to war-crimes proceedings), roughly 25% are local administrations such as city councils, and the remainder are defense-sector entities (including drone-related organizations) and a major transportation hub for foreign military assistance. The targeting is consistent with Russian intelligence priorities: monitoring war-crimes investigations, assessing damage from Russian strikes, tracking local defense initiatives and military supply routes. The research was presented by ESET at Virus Bulletin 2026.

In 2025 the group gained initial access through spearphishing emails, often sent from compromised legitimate Ukrainian local government mailboxes, carrying .xlsm attachments with lures about administrative fines, tax notices and official correspondence. A VBA macro decoded a base64-encoded payload held in spreadsheet cells, dropped it to %ProgramData% and executed it. In early 2026 the group switched to RAR archives exploiting CVE-2025-8088, a WinRAR path traversal flaw (versions through 7.12, fixed in 7.13) abused through NTFS alternate data streams so that content is extracted outside the folder the user selected. The archive shows a decoy PDF while placing an encrypted payload and a PowerShell loader in %ProgramData% and an LNK file in the Windows Startup folder, which launches the loader at the next logon. CVE-2025-8088 was reported by ESET and was earlier exploited as a zero-day by RomCom; it was added to CISA KEV on 2025-08-12.

The toolset is small. Prime ReverseShell is a PowerShell reverse shell derived from the public PSSW100AVB GitHub project, compiled to a .NET executable with PS2EXE and used before BeautyStealer. One variant embedded a comment addressed to LLMs/AI analysis tools claiming the file is a harmless prime-number generator; ESET found it ineffective. BeautyStealer is a C++ infostealer (versions 0.9, 1.1, 1.2, 2.0) that collects cookies, saved passwords and local state from Chrome, Edge, Opera and Firefox, OpenVPN configurations from user and system directories, and files from Desktop, Documents and Downloads, removable media and mapped network drives. It targets roughly 40 extensions including Office documents, archives, email (.eml), KeePass (.kdbx), Java keystores (.jks), RDP (.rdp), PFX (.pfx), OpenVPN (.ovpn) and Ukrainian electronic signature key files (.zs2). Early versions (0.9-1.1) exfiltrated through the Telegram API (sendDocument); from v1.2 a custom FastAPI-based C2 server is used. Encoding progressed from Base64 to XOR (v1.2) to RC4 (v2.0). The stealer deletes itself after exfiltration (BAT scripts in earlier versions, Windows API calls later).

ESET assesses the operation as prioritizing rapid collection over long-term persistence and suggests Gorbag may act as an access/credential broker passing stolen data to other actors, though follow-on activity is unconfirmed. Attribution is to a Russia-aligned actor based on targeting; no state sponsor or link to a known group has been established.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1586.002 Compromise Accounts: Email Accounts
- T1587.001 Develop Capabilities: Malware
- T1588.001 Obtain Capabilities: Malware
- T1588.005 Obtain Capabilities: Exploits
- T1566.001 Phishing: Spearphishing Attachment
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.005 Command and Scripting Interpreter: Visual Basic
- T1203 Exploitation for Client Execution
- T1204.002 User Execution: Malicious File
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1070.004 Indicator Removal: File Deletion
- T1027.009 Obfuscated Files or Information: Embedded Payloads
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1071.001 Application Layer Protocol: Web Protocols
- T1567 Exfiltration Over Web Service
- T1564.004 Hide Artifacts: NTFS File Attributes
- T1199 Trusted Relationship
- T1217 Browser Information Discovery
- T1560.001 Archive Collected Data: Archive via Utility
- T1573.001 Encrypted Channel: Symmetric Cryptography

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Gorbag CVE-2025-8088 WinRAR Path-Traversal Drop to Startup/ProgramData** (`TL-2026-5198-SPL-001`)

Detects WinRAR/UnRAR writing an LNK into the user Startup folder or a loader/payload (.ps1, .lnk, .exe, .dll, .dat) into ProgramData, the on-disk signature of the CVE-2025-8088 alternate-data-stream path traversal used by Gorbag since early 2026 to stage a PowerShell loader that deploys BeautyStealer. Legitimate archive extraction rarely lands files in the Startup folder, so this is a behaviour-first exploit-trigger detection.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1203, T1547.001, T1204.002, T1027.009
- **Data sources:** sysmon, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 (Image="*WinRAR.exe" OR Image="*UnRAR.exe" OR Image="*Rar.exe") (TargetFilename="*Start Menu*Programs*Startup*.lnk" OR TargetFilename="*ProgramData*.ps1" OR TargetFilename="*ProgramData*.lnk" OR TargetFilename="*ProgramData*.exe" OR TargetFilename="*ProgramData*.dll" OR TargetFilename="*ProgramData*.dat") | stats count min(_time) as first_seen max(_time) as last_seen values(TargetFilename) as dropped_files by host, User, Image | convert ctime(first_seen) ctime(last_seen) | eval threat="TL-2026-5198 Gorbag CVE-2025-8088 WinRAR path traversal"
```

### Microsoft KQL

```kql
DeviceFileEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("WinRAR.exe", "UnRAR.exe", "Rar.exe")
| where (FolderPath has "Start Menu" and FolderPath has "Startup" and FileName endswith ".lnk")
    or (FolderPath has "ProgramData" and (FileName endswith ".ps1" or FileName endswith ".lnk" or FileName endswith ".exe" or FileName endswith ".dll" or FileName endswith ".dat"))
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, FileName, SHA1
```

### Sigma

```yaml
title: Gorbag CVE-2025-8088 WinRAR Path Traversal Drop to Startup or ProgramData
id: 3f6c1d52-8a41-4b7e-9c2a-5d1e7b9a0c11
status: experimental
description: Detects WinRAR or UnRAR writing an LNK to the Startup folder or a loader and payload to ProgramData, consistent with exploitation of CVE-2025-8088 by Gorbag to stage a PowerShell loader for BeautyStealer.
references:
    - https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/
    - https://nvd.nist.gov/vuln/detail/CVE-2025-8088
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-04
tags:
    - attack.execution
    - attack.t1203
    - attack.persistence
    - attack.t1547.001
    - attack.t1204.002
    - cve.2025.8088
logsource:
    category: file_event
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\WinRAR.exe'
            - '\UnRAR.exe'
            - '\Rar.exe'
    selection_startup:
        TargetFilename|contains: '\Start Menu\Programs\Startup\'
        TargetFilename|endswith: '.lnk'
    selection_programdata:
        TargetFilename|startswith: 'C:\ProgramData\'
        TargetFilename|endswith:
            - '.ps1'
            - '.lnk'
            - '.exe'
            - '.dll'
            - '.dat'
    condition: selection_img and (selection_startup or selection_programdata)
falsepositives:
    - Legitimate extraction of installers or admin tooling into ProgramData with WinRAR
    - Administrators distributing Startup shortcuts inside archives
level: high
```

**Known false positives:**

- Legitimate extraction of installers or admin tooling into C:\ProgramData with WinRAR
- Administrators distributing Startup shortcuts inside archives

**Tuning notes:** Requires Sysmon EventID 11 (FileCreate) with WinRAR/UnRAR in scope. Allow-list known software-deployment accounts and extraction paths, and consider raising to critical when the WinRAR build is 7.12 or earlier (fixed in 7.13).

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Gorbag Macro-Enabled Excel Dropper — ProgramData Payload Written then Executed (locked: unlock with TL Creds)
- Gorbag Prime ReverseShell — PS2EXE .NET Binary Hosting PowerShell Engine (locked: unlock with TL Creds)
- Gorbag BeautyStealer Telegram Bot API Exfiltration by Non-Browser Process (locked: unlock with TL Creds)
- Gorbag Lure Filenames and Published Malware Hashes (locked: unlock with TL Creds)
- Gorbag BeautyStealer Browser Credential and Cookie Store Access by Non-Browser Process (locked: unlock with TL Creds)
- Gorbag BeautyStealer Self-Deletion Command After Exfiltration (locked: unlock with TL Creds)
- Gorbag Startup LNK Launching PowerShell Loader from ProgramData at Logon (locked: unlock with TL Creds)
- Gorbag Network Connections to Known Prime ReverseShell C2 and BeautyStealer Exfil IPs (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 22)

Defanged, TLP:CLEAR.

- IP address: `89.44.9[.]186`
- File hash: `C17369B4B49113D07F080DF832E218156FB0940F`
- IP address: `142.111.194[.]73`

Full set of 22 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Gorbag: Orcs at the border harvesting intelligence from Ukraine (ESET Research)](https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/)
- [Russia-linked cyber spies target Ukraine's war crimes investigations, military aid routes (The Record)](https://therecord.media/russia-linked-cyber-spies-target-ukraine-war-support)
- [Gorbag APT group hits Ukrainian courts and city councils with self-deleting malware (Help Net Security)](https://www.helpnetsecurity.com/2026/11/03/gorbag-apt-group-malware/)
- [Russia-Aligned Gorbag Targets Ukraine for Intelligence (Infosecurity Magazine)](https://www.infosecurity-magazine.com/news/russia-gorbag-targets-ukraine/)
- [Russia Smashes and Grabs Credentials in Ukrainian Campaign (BankInfoSecurity/DataBreachToday)](https://www.databreachtoday.com/russia-smashes-grabs-credentials-in-ukrainian-campaign-a-33278)
- [ESET Research uncovers Gorbag, Russia-aligned threat group harvesting intelligence from Ukraine (ESET press release)](https://www.manilatimes.net/2026/11/03/tmt-newswire/globenewswire/eset-research-uncovers-gorbag-russia-aligned-threat-group-harvesting-intelligence-from-ukraine/2460378)
- [Gorbag: Orcs at the border (Virus Bulletin 2026 abstract)](https://www.virusbulletin.com/conference/vb2026/abstracts/gorbag-orcs-border/)
- [ESET malware-ioc: Gorbag indicators](https://github.com/eset/malware-ioc/tree/master/gorbag)
- [NVD: CVE-2025-8088 (WinRAR path traversal)](https://nvd.nist.gov/vuln/detail/CVE-2025-8088)
- [CISA Known Exploited Vulnerabilities Catalog (CVE-2025-8088 added 2025-08-12)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5198