ESET exposes Gorbag stealing data from Ukrainian government and defense bodies via spearphishing and WinRAR flaw CVE-2025-8088

ESET researchers exposed a Russia-aligned threat actor they named Gorbag, active since at least February 2025 and focused exclusively on Ukrainian targets, especially law enforcement and justice entities, local administrations near the front line, the defense sector and a major transportation hub for foreign military aid ^[1]. The group delivers the Prime ReverseShell and the BeautyStealer stealer through spearphishing attachments and in early 2026 began abusing WinRAR path traversal flaw CVE-2025-8088; iThome reports it has sent malicious attachments from a compromised Ukrainian local government email account ^[1][2]. Security teams can check their environments against the IoCs and samples ESET published on GitHub ^[1].

Industries mainly affected: Government, Transportation & logistics, Defense

Security teams can check their environments against the IoCs and samples ESET published on GitHub ^[1]