Russian-Aligned Gorbag Group Exploits WinRAR CVE-2025-8088 to Steal Credentials from Ukrainian Government Bodies
ESET has released a report dated 3 November 2026 detailing the activities of the Gorbag group, a Russia-aligned threat actor active since at least February 2025. The group has begun exploiting the WinRAR vulnerability CVE-2025-8088 to install the BeautyStealer password-stealing malware on Ukrainian public sector systems.
The flaw is a path traversal issue that allows specially crafted RAR archives to write files outside the user-selected extraction directory. Attackers leverage Windows alternate data streams to place malicious components in other locations on the disk. The vulnerability was patched in WinRAR version 7.13, and Gorbag adopted the exploit after the RomCom group had already used it in phishing campaigns.
When a victim opens the malicious RAR file, a decoy PDF is displayed while a shortcut is placed in the Windows startup folder and a PowerShell loader together with an encrypted payload is written to disk. The shortcut ensures the loader executes on every system boot, providing persistence without further victim interaction.
BeautyStealer, a C++ infostealer, collects saved passwords, cookies, and browsing state from Chrome, Edge, Opera, and Firefox. It also searches for OpenVPN and remote access configurations, KeePass databases, Java key files, and Ukrainian electronic signature keys. The malware scans removable media and mapped network drives.
Targets include government agencies, police, justice institutions, local administrations, and defense organizations. Approximately one quarter of identified victims are justice or public security bodies, while another quarter are municipal administrations, many located near the front line. ESET assesses the motivation may relate to war-crimes investigations but treats this as an unconfirmed hypothesis.
The group changed tactics during the campaign. In 2025, operations relied on emails containing malicious Excel spreadsheets about fines and taxes, often sent from compromised Ukrainian local government mailboxes, and required victims to enable macros. By early 2026, delivery shifted to RAR archives that bypass the need for macro execution.
Stolen data is compressed and sent via the Telegram API or, starting with version 1.2 of the malware, to attacker-operated servers. Recommended defenses include updating WinRAR to version 7.13 or later, blocking unauthorized shortcuts and scripts in the startup folder, and disabling Office macros by policy.
Related articles
Positive Technologies Analyzes 140 Incidents: Web Applications Drive Half of Breaches, APT Groups Found in 49% of Cases
Positive Technologies' Incident Response team examined more than 140 full-cycle investigations and retrospective analyses conducted between Q4 2025 and Q3 2026. Web applications on the perimeter remained the leading initial access vector, accounting for 50.8% of incidents, with newly targeted services including Zimbra mail servers and TrueConf video-conferencing platforms. APT activity was detected in 49.3% of victim organizations, while supply-chain attacks through contractors and ViPNet networks still represented 14.9% of entries despite a decline from the previous year. Industry became the most affected sector at 22.5%, and median time to bring incidents under control after engagement stood at two days. Root causes continued to center on outdated software, missing multi-factor authentication, and poor network segmentation. Three previously unknown APT groups—APT10051, Stingy Basilisk, and Chewbacca—were identified during the investigations.
Peskov Rejects Claims of Russian Involvement in European Refrigeration System Attacks
Kremlin spokesman Dmitry Peskov has dismissed accusations that Russian-linked cyber groups were behind recent attacks on industrial refrigeration equipment across nine European countries. The incidents, which occurred in early November, involved unauthorized changes to temperature settings on internet-connected cooling systems, with some units pushed to +50 °C. Similar attacks had already been reported in France during October, affecting meat producers and other facilities that rely on precise climate control. Peskov described the allegations as lacking any evidence and part of a recurring pattern of unsubstantiated claims directed at Russia by European nations. The targeted systems are typically connected online for remote maintenance and fault alerts, a feature that becomes a liability when external actors gain access. No group has claimed responsibility for the October or November operations, leaving attribution unconfirmed. The events highlight risks associated with exposing industrial control equipment directly to the internet without adequate segmentation or authentication controls.
North Korean Hacker Groups: Lazarus, Kimsuky, Andariel and Financial Clusters Behind Billions in Thefts
North Korean state-sponsored hacking operations linked to the Reconnaissance General Bureau and other agencies involve dozens of clusters conducting cyber espionage, technology theft, and large-scale financial crimes. Groups such as Lazarus, Kimsuky, Andariel, BlueNoroff, and APT38 have been tied to the 2014 Sony Pictures breach, the 2016 Bangladesh Bank heist, WannaCry, and recent multi-billion-dollar cryptocurrency thefts from Bybit and Binance. Specialized teams focus on fake job offers to infiltrate defense contractors, supply-chain attacks on developers, and ransomware operations that fund further espionage. Researchers from Microsoft, CrowdStrike, Google, and Mandiant track overlapping clusters using names like Diamond Sleet, Labyrinth Chollima, TraderTraitor, and UNC2970, noting frequent infrastructure sharing and evolving tactics. The activity spans political intelligence collection, defense technology theft, and crypto wallet compromises, with some clusters creating fictitious IT workers to gain remote access to foreign companies.
China-Linked WARP PANDA Exploits VMware ESX Zero-Day CVE-2026-41709 to Evade Logging
CrowdStrike reported on 28 October 2026 that the China-linked group WARP PANDA used CVE-2026-41709, a zero-day in VMware ESX, to operate without leaving records on compromised hypervisors. The vulnerability carries a low CVSS 3.1 score of 2.7 and was added the same day to the CISA Known Exploited Vulnerabilities catalog with a remediation deadline of 11 November. Broadcom describes the flaw as insufficient logging that allows a malicious administrator to execute certain operations without them appearing in logs. The issue does not enable remote code execution or privilege escalation on its own; its value lies in erasing the audit trail that incident responders rely on to reconstruct activity. CrowdStrike linked the exploitation to espionage operations against U.S. legal-sector organizations, with activity intensifying in early 2026. The report also highlights deployment of BRICKSTORM and SharpStorm malware in vCenter environments along with stolen cloud session tokens. Broadcom has released fixed builds for ESXi 9.1, 9.0.2 and 8.0 U3j, while VMware Cloud Foundation 5 requires version 5.2.4.