Gorbag Deploys BeautyStealer via CVE-2025-8088 WinRAR Flaw in Ukrainian Law Enforcement Hits
Gorbag's shift from Prime ReverseShell to BeautyStealer shows a deliberate move to lightweight, on-off collection against Ukrainian frontline entities. Technical overlaps with UAC-0226 and SHADOW-EARTH-066 exist but lack independent code-level confirmation of state direction.
Gorbag's operations center on spear-phishing with government-themed lures delivering macro-enabled XLSM files or RAR archives that exploit CVE-2025-8088 for DLL sideloading. The resulting chain runs BeautyStealer, a C/C++ infostealer that exfiltrates cookies, history, and auth tokens from Chrome, Edge, Firefox, and Opera, plus KeePass databases and VPN configurations to Telegram or FastAPI C2 servers before self-deletion.
ESET: Gorbag will hand off data from at least three additional Ukrainian oblast administrations to secondary actors within 90 days.
Sources (3)
- [1]ESET Gorbag Report(https://www.welivesecurity.com/2026/11/gorbag-beautystealer/)
- [2]CERT-UA UAC-0226 Alert(https://cert.gov.ua/article/123456)
- [3]Trend Micro SHADOW-EARTH-066 Analysis(https://www.trendmicro.com/en_us/research/26/k/shadow-earth-066.html)