Gorbag: The Russia-Aligned APT Quietly Draining Ukrainian VPN Credentials One Pass at a Time
Executive Summary
Executive Summary Beginning in February 2025, a Russia-aligned threat actor tracked as Gorbag launched a highly targeted espionage campaign against Ukrainian law enforcement, local administrations near the front line, and defense-sector entities. The group delivered its custom C++ infostealer, BeautyStealer, via spearphishing emails carrying malicious Excel macros, and later via weaponized RAR archives exploiting CVE-2025-8088, a WinRAR path traversal zero-day. BeautyStealer harvested browser credentials, OpenVPN configurations, and sensitive documents in a single pass before self-deleting, with stolen data exfiltrated over Telegram or a FastAPI-backed C2 server. Gorbag's tradecraft suggests it may function as an initial access broker feeding credentials to downstream Russia-aligned actors.
Gorbag illustrates a growing pattern of lean, single-pass infostealers designed for rapid intelligence collection rather than persistent implantation. The exploitation of a freshly disclosed WinRAR zero-day underscores how quickly Russia-aligned groups weaponize new CVEs, and the campaign's focus on VPN credentials and electronic signature keys signals a deliberate effort to enable follow-on network intrusions at scale.
Why This Matters Now
Why This Matters NowActive since February 2025 and still evolving, Gorbag adopted CVE-2025-8088 within months of its disclosure, demonstrating near-real-time CVE weaponization. Its theft of OpenVPN configs and Ukrainian electronic signature keys (.zs2) creates direct pathways for deeper network compromise by downstream actors, making credential-based lateral movement a clear and present risk for any organization relying on unmonitored egress and flat network trust.
Attack Path Analysis
Attack Path AnalysisGorbag, a Russia-aligned threat actor, initiated attacks against Ukrainian governmental, law enforcement, and defense targets via spearphishing emails with malicious macro-enabled attachments or weaponized RAR archives exploiting CVE-2025-8088, a WinRAR path traversal zero-day. Upon execution, BeautyStealer harvested browser credentials, VPN configurations, and sensitive documents in a single pass, then exfiltrated compressed and encrypted data to attacker-controlled Telegram channels or a custom FastAPI C2 server before self-deleting to minimize forensic traces. The operation was designed for rapid, one-time intelligence collection aligned with Russian wartime priorities, with collected credentials potentially shared with other threat actors as an initial access broker.
Kill Chain Progression
Kill Chain ProgressionThis analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
DescriptionGorbag delivered spearphishing emails from compromised Ukrainian government email accounts containing macro-enabled Excel (.xlsm) attachments or weaponized RAR archives exploiting CVE-2025-8088. Enabling macros or opening the RAR on a vulnerable WinRAR installation dropped BeautyStealer or a PowerShell loader into %ProgramData%, with a LNK file placed in the Windows Startup folder for persistence. The use of trusted sender accounts increased victim likelihood of opening attachments.
Related CVEs
Related CVEsCVE-2025-8088
CVSS 8.8A path traversal vulnerability in WinRAR allows specially crafted RAR archives to extract files outside the user-selected destination directory via alternate data streams, enabling arbitrary file placement such as dropping malicious LNK files into the Windows Startup folder for persistence and code execution.
Affected Products:
RARLAB WinRAR – < patched version released post August 2025
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
MITRE ATT&CK® TechniquesPhishing: Spearphishing Attachment
Exploitation for Client Execution
Command and Scripting Interpreter: PowerShell
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Credentials from Password Stores: Credentials from Web Browsers
Steal Web Session Cookie
Obfuscated Files or Information: Embedded Payloads
Indicator Removal: File Deletion
Data from Local System
Archive Collected Data: Archive via Utility
Exfiltration Over Web Service
Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol
Application Layer Protocol: Web Protocols
Acquire Infrastructure
Compromise Accounts: Email Accounts
Develop Capabilities: Malware
Obtain Capabilities: Exploits
Trusted Relationship
User Execution: Malicious File
Browser Information Discovery
Potential Compliance Exposure
Potential Compliance ExposureMapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev 5 – Malicious Code Protection / Anti-Spam / Mobile Code
Control ID: SI-3 / SI-8 / SC-18
NIS2 Directive (EU) 2022/2555 – Incident Handling, Supply Chain Security, and Vulnerability Management
Control ID: Article 21 – Cybersecurity Risk Management Measures
DORA (EU) 2022/2554 – ICT Risk and Threat-Led Security Controls
Control ID: Article 9 – ICT Security; Article 17 – ICT-related Incident Management
CISA Zero Trust Maturity Model 2.0 – Credential Hygiene and Sensitive Data Protection
Control ID: Identity Pillar – Credential Management; Data Pillar – Data Loss Prevention
ISO/IEC 27001:2022 – Malware Defenses, Patch Management, and Data Exfiltration Controls
Control ID: Annex A 8.7 – Protection Against Malware; Annex A 8.8 – Management of Technical Vulnerabilities; Annex A 8.12 – Data Leakage Prevention
NYDFS 23 NYCRR Part 500 – Cybersecurity Policy, Awareness Training, and Incident Response
Control ID: Section 500.3 – Cybersecurity Policy; Section 500.14 – Training; Section 500.16 – Incident Response Plan
PCI DSS 4.0 – Anti-Malware Controls and Incident Response Readiness
Control ID: Requirement 5 – Protect All Systems Against Malware; Requirement 12.10 – Incident Response Plan
Sector Implications
Sector ImplicationsIndustry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Government Administration
Gorbag's infostealer/espionage campaign directly targets Ukrainian local administrations, exfiltrating browser credentials, VPN configs, and Office documents via BeautyStealer, with egress exfiltration and lateral movement controls critically absent.
Law Enforcement
Ukrainian law enforcement entities face acute risk from BeautyStealer harvesting .zs2 electronic signature keys, .kdbx password stores, and .rdp credentials, enabling Russia-aligned actors to monitor war crimes investigations and expose informants.
Defense/Space
Defense sector and military aid logistics hubs are primary Gorbag targets; stolen OpenVPN configurations and RC4-encrypted exfiltration via Telegram bypass egress controls, exposing supply chain intelligence to Russian wartime collection priorities.
Transportation
A major foreign military aid transportation hub is explicitly targeted by Gorbag's spearphishing and CVE-2025-8088 WinRAR exploit chain, threatening logistics confidentiality and enabling Russian battle damage assessment of critical supply infrastructure.
Sources
Sources- Gorbag: Orcs at the border harvesting intelligence from Ukrainehttps://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/Verified
- CERT-UA Advisory on UAC-0226 and GIFTEDCROOKhttps://cert.gov.ua/article/6282946Verified
- GIFTEDCROOK: Strategic Pivot from Browser Stealer to Data Exfiltration Platformhttps://arcticwolf.com/resources/blog/giftedcrook-strategic-pivot-from-browser-stealer-to-data-exfiltration-platform/Verified
- Old WinRAR Flaw Fuels Attacks on Ukrainehttps://www.trendmicro.com/en_us/research/26/f/old-winrar-flaw-fuels-attacks-on-ukraine.htmlVerified
- Gorbag: Orcs at the border - Virus Bulletin White Paperhttps://virusbulletin.com/uploads/pdf/conference/vb2026/papers/Gorbag-Orcs-at-the-border.pdfVerified
- ESET Research: Update WinRAR Now - RomCom and Others Exploiting Zero-Day Vulnerabilityhttps://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/Verified
- ESET Malware IoC Repository - Gorbaghttps://github.com/eset/malware-ioc/tree/master/gorbagVerified
Frequently Asked Questions
Frequently Asked QuestionsCloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant to this incident because Gorbag's operation depended on unrestricted outbound connectivity and broad east-west reachability from a compromised endpoint to exfiltrate credentials, VPN configs, and sensitive documents to external C2 infrastructure. By enforcing segmented workload access and controlled egress policies, CNSF would likely have reduced the attacker's ability to reach internal network resources and communicate freely with attacker-controlled Telegram channels and FastAPI C2 servers.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Workload segmentation enforced at the network fabric layer could limit the initial foothold's ability to communicate outward or reach adjacent cloud-hosted resources, even after successful endpoint compromise, reducing the effective blast radius of the initial payload execution.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation policies could limit which network-attached resources the compromised user context is permitted to reach, reducing the scope of credential and file material accessible from the initial foothold and constraining the breadth of what BeautyStealer could harvest from mapped drives or cloud-connected storage.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement across workload segments would likely constrain downstream actors attempting to leverage harvested RDP credentials or VPN configs to move laterally between cloud-hosted systems, reducing the reachability of internal workloads from newly authenticated but untrusted sessions.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility and centralized traffic control could surface anomalous outbound HTTPS sessions to unknown external IPs and reduce the ability of both the reverse shell and FastAPI C2 to maintain reliable command channels from within the cloud environment, constraining attacker responsiveness during the operation.
Control: Egress Security & Policy Enforcement
Mitigation: Controlled egress policies enforced at the cloud network boundary could limit outbound data flows to the Telegram API and the FastAPI C2 server, reducing the attacker's ability to reliably complete bulk exfiltration of compressed credential archives from cloud-connected workloads.
Even with prior-stage controls reducing exfiltration reliability and lateral reachability, residual risk remains around endpoint-resident credential material and locally accessible sensitive files that CNSF network controls cannot directly govern, meaning the intelligence collection impact may be partially reduced in scope but not fully eliminated.
Impact at a Glance
Affected Business Functions
- Law Enforcement Case Management and War Crimes Documentation
- Local Government Administrative Operations and Civil Defense Coordination
- Defense Sector Logistics and Foreign Military Aid Infrastructure
- VPN and Remote Access Credential Management
Estimated downtime: N/A
Estimated loss: N/A
Highly sensitive Ukrainian government and defense data was targeted and exfiltrated in single-pass operations, including: browser-stored credentials and session cookies from law enforcement and justice personnel; OpenVPN and remote access configuration files enabling follow-on network infiltration; Ukrainian electronic signature keys (.zs2) used for official government authentication; Microsoft Office documents, emails, and archives from Desktop, Documents, and Downloads folders of targeted officials; KeePass password databases (.kdbx), RDP configuration files, and PFX private key files. Victims span Ukrainian law enforcement prosecutors and judges actively working on Russian war crimes cases, local city council administrators near the front line managing battle damage assessments and civil defense, and personnel at a major foreign military aid logistics hub. The intelligence value of this data to Russian wartime operations is assessed as extremely high, including visibility into war crimes investigations, frontline administrative activities, incoming military supply chains, and potential credentials for follow-on intrusion by other Russia-aligned threat actors acting as downstream consumers of Gorbag-collected material.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy Egress Security & Policy Enforcement (FQDN filtering and outbound traffic controls) to block unauthorized exfiltration channels including Telegram API endpoints and unknown FastAPI C2 destinations, directly disrupting BeautyStealer's primary exfiltration pathways.
- • Implement Encrypted Traffic inspection and Inline IPS (Suricata) with signatures for known malicious payload patterns, CVE-2025-8088 exploit traffic, and RC4/XOR-encrypted archive transfers to detect and block data staging and exfiltration before data leaves the network perimeter.
- • Enforce Zero Trust Segmentation with least-privilege identity-based policies to restrict user endpoints from accessing mapped network drives, removable media, and VPN configuration directories beyond operational necessity, limiting BeautyStealer's lateral file collection scope.
- • Activate Multicloud Visibility & Control with centralized traffic observability to baseline normal outbound communication patterns and generate alerts on anomalous connections to newly registered or low-reputation C2 infrastructure such as those hosted by M247 Europe SRL and EGIHosting.
- • Apply Cloud Firewall (ACF) egress controls with URL and FQDN filtering to prevent PowerShell reverse shell callbacks and block outbound HTTPS connections to attacker-controlled servers, ensuring Prime ReverseShell C2 sessions are terminated at the network edge before command execution is possible.
