Gorbag's Infostealer Playbook: How a Russia-Aligned Group Is Harvesting Ukrainian Defense Secrets with WinRAR Exploits
Executive Summary
Executive Summary Since at least February 2025, a Russia-aligned threat actor designated Gorbag (also tracked as UAC-0226 and SHADOW-EARTH-066) has conducted targeted cyber-espionage campaigns against Ukrainian law enforcement, local administrations near the front line, and defense-sector organizations. The group delivers infostealers—primarily GIFTEDCROOK and BeautyStealer—via spear-phishing emails carrying macro-enabled Excel attachments or by exploiting a now-patched WinRAR vulnerability (CVE-2025-8088) to trigger DLL sideloading. Stolen data, including browser credentials, cookies, VPN configurations, and sensitive documents, is exfiltrated to attacker-controlled Telegram chats or FastAPI-based C2 servers before the malware self-deletes, leaving minimal forensic trace.
Gorbag's operations illustrate a broader 2025–2026 trend of state-aligned actors prioritizing lightweight, purpose-built infostealers over complex implants to reduce detection risk. The group's potential role as an initial access broker—harvesting VPN credentials that enable downstream intrusions—signals compounding risk for organizations that have not enforced egress controls, segmented internal traffic, or encrypted data in transit.
Why This Matters Now
Why This Matters NowWith active conflict driving Russian intelligence collection priorities, Gorbag's credential and VPN-config harvesting has immediate resale and follow-on intrusion value. The group's exploitation of a patched WinRAR CVE and prompt-injection attempts against AI security tools signal that adversaries are actively testing defenses used in modern SOCs—making robust egress filtering, encrypted transit, and east-west segmentation urgent priorities for any organization handling sensitive government or defense data.
Attack Path Analysis
Attack Path AnalysisRussia-aligned Gorbag (UAC-0226) targeted Ukrainian law enforcement, local administrations, and defense entities using spear-phishing emails with malicious attachments — either macro-enabled Excel (.XLSM) files or WinRAR archives exploiting CVE-2025-8088 — to deliver GIFTEDCROOK or BeautyStealer infostealers alongside a Prime ReverseShell for command execution. Once active on the host, the malware harvested browser credentials, cookies, VPN configurations, and sensitive documents, compressed the stolen data, and exfiltrated it to attacker-controlled Telegram chats or a FastAPI-based C2 server before self-deleting to avoid forensic detection.
Kill Chain Progression
Kill Chain ProgressionThis analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
DescriptionGorbag delivered spear-phishing emails with government-themed lures (administrative fines, tax documents) carrying malicious .XLSM attachments containing VBA macros, or WinRAR archives exploiting CVE-2025-8088 to trigger a DLL sideloading chain. Macro execution decoded and launched BeautyStealer or GIFTEDCROOK on the victim endpoint. The use of prompt-injection comments in PowerShell scripts attempted to evade AI-based security tooling.
Related CVEs
Related CVEsCVE-2023-38831
CVSS 7.8A vulnerability in WinRAR before version 6.23 allows attackers to execute arbitrary code when a user opens a crafted archive, due to improper handling of file extensions in ZIP archives, enabling DLL sideloading and arbitrary code execution chains such as those used to deploy GIFTEDCROOK stealer malware.
Affected Products:
RARLAB WinRAR – < 6.23
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
MITRE ATT&CK® TechniquesPhishing: Spearphishing Attachment
Exploitation for Client Execution
Command and Scripting Interpreter: Visual Basic
Hijack Execution Flow: DLL Side-Loading
Credentials from Password Stores: Credentials from Web Browsers
Archive Collected Data: Archive via Utility
Application Layer Protocol: Web Protocols
Exfiltration Over C2 Channel
Potential Compliance Exposure
Potential Compliance ExposureMapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev 5 – Malicious Code Protection and Mobile Code Controls
Control ID: SI-3, SI-8, SC-18
NIS2 Directive (EU) 2022/2555 – Risk Management and Incident Handling for Essential Entities
Control ID: Article 21(2)(a), 21(2)(e)
CISA Zero Trust Maturity Model 2.0 – Device Health Validation and Identity-Aware Access Controls
Control ID: Identity Pillar — Attribute-Based Access, Device Pillar — Endpoint Detection
DORA (EU) 2022/2554 – ICT Security — Threat Detection and Response Controls
Control ID: Article 9(4)(b), Article 10
ISO/IEC 27001:2022 – Malware Controls, Monitoring, and Third-Party Channel Security
Control ID: Annex A 8.7 (Malware Protection), A 8.16 (Monitoring Activities), A 5.23 (Information Security for Use of Cloud Services)
GDPR (EU) 2016/679 – Technical Security Measures and Breach Notification
Control ID: Article 32 (Security of Processing), Article 33 (Notification of Personal Data Breach)
Sector Implications
Sector ImplicationsIndustry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Government Administration
Russia-aligned Gorbag cyber espionage targets Ukrainian local administrations via spear-phishing and GIFTEDCROOK infostealer, exfiltrating browser credentials, VPN configs, and sensitive documents through unmonitored egress channels.
Law Enforcement
Gorbag's WinRAR CVE-2025-8088 exploitation and BeautyStealer malware specifically prioritize law enforcement and justice entities, harvesting authentication data, RDP configs, and KeePass databases critical to operational security.
Military Industry
Defense sector organizations face targeted infostealer campaigns harvesting VPN configurations and operational documents, with validated egress exfiltration risks mapped to NIST.800-53.SC-18 and PCI.4.0.3.5.1 compliance frameworks.
Public Safety
Frontline administrative and public safety entities near conflict zones are primary Gorbag targets, with lateral movement and unencrypted data-in-transit risks amplifying credential theft and wartime intelligence collection exposure.
Sources
Sources- Russia-Aligned Gorbag Hackers Exploit WinRAR Flaw to Deploy Data-Stealing Malwarehttps://thehackernews.com/2026/11/russia-aligned-gorbag-hackers-exploit.htmlVerified
- NVD - CVE-2023-38831 WinRAR Code Execution Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2023-38831Verified
- CISA Known Exploited Vulnerabilities Catalog - CVE-2023-38831https://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- CERT-UA Alert UAC-0226 - GiftedCrook Stealer Deployment Against Ukrainian Organizationshttps://cert.gov.ua/article/6278142Verified
- ESET Research - Gorbag / ORCS at the Border: Harvesting Intelligence from Ukrainehttps://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/Verified
- The Hacker News - UAC-0226 Deploys GiftedCrook Stealer via Malicious Excel Files Targeting Ukrainehttps://thehackernews.com/2025/04/uac-0226-deploys-giftedcrook-stealer.htmlVerified
- Group-IB - WinRAR Zero-Day CVE-2023-38831 Used in Cyberattackshttps://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/Verified
- RARLAB Security Advisory - WinRAR 6.23 Release Noteshttps://www.rarlab.com/security/rarlab_security_advisory.htmlVerified
Frequently Asked Questions
Frequently Asked QuestionsCloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant to this incident because Gorbag's success depended on an infected endpoint reaching cloud-hosted C2 infrastructure and exfiltrating sensitive data outbound without restriction. By enforcing workload-level segmentation, identity-scoped access, and controlled egress, CNSF would likely reduce the attacker's ability to establish persistent outbound channels and limit the blast radius of stolen credentials used for downstream lateral access.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: While endpoint compromise via phishing cannot be prevented by network fabric controls, CNSF's workload-aware policy enforcement would likely constrain the newly compromised host's ability to reach internal cloud resources or initiate unsanctioned outbound connections immediately after macro execution, reducing the effective reachability of the malware from the moment it lands.
Control: Zero Trust Segmentation
Mitigation: Even if stolen VPN credentials were replayed by a downstream actor, Zero Trust segmentation would likely constrain which network segments and workloads that identity could actually reach, reducing the privilege scope available to anyone reusing those harvested credentials to move through cloud environments.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement would likely constrain a broker-acquired actor attempting to pivot laterally using stolen RDP files or authentication cookies, as workload-to-workload communication paths would be governed by explicit policy rather than open trust assumptions, reducing how many segments or hosts could be reached from a single compromised identity.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility and control would likely surface anomalous outbound connection patterns from workloads or endpoints reaching attacker-controlled FastAPI infrastructure or Telegram API endpoints, and policy enforcement could constrain those communication paths, reducing the reliability of C2 channels even when they attempt to blend with legitimate HTTPS traffic.
Control: Egress Security & Policy Enforcement
Mitigation: Egress policy enforcement would likely reduce the attacker's ability to successfully transmit compressed archives containing harvested credentials and documents to Telegram or attacker-hosted FastAPI endpoints, as outbound HTTPS flows to those destinations would require explicit policy authorization that sanctioned workloads would not normally hold.
Had prior CNSF controls constrained C2 reachability and egress paths, the volume of successfully exfiltrated material — browser credentials, KeePass databases, OpenVPN configurations, and government documents — would likely have been reduced, limiting the intelligence value delivered to Gorbag and lowering the downstream risk posed by credential reuse in future broker-facilitated intrusions.
Impact at a Glance
Affected Business Functions
- Law Enforcement Case Management and Criminal Justice Records
- Local Government Administrative Operations and Citizen Data Systems
- Defense Sector Operational Planning and Personnel Data
- VPN and Remote Access Infrastructure for Government Personnel
Estimated downtime: N/A
Estimated loss: N/A
The Gorbag threat actor's campaigns resulted in confirmed exfiltration of highly sensitive data categories from Ukrainian government and defense organizations, including: browser-stored authentication credentials, session cookies, and browsing history from Chrome, Edge, Opera, and Firefox; OpenVPN and commercial VPN configuration files enabling potential follow-on network access; Microsoft Office documents, email archives, and KeePass password database files; RDP configuration files; and files matching government and defense-relevant extensions. The targeting of law enforcement, front-line local administrations, and the defense sector indicates exposure of operationally sensitive wartime intelligence including personnel records, case files, administrative communications, and potentially classified operational documents. Harvested VPN credentials and configurations raise the additional risk of Gorbag acting as an initial access broker, meaning stolen data may be further leveraged by secondary threat actors for deeper intrusion into Ukrainian government and defense networks.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy Inline IPS (Suricata-based) with up-to-date signatures for CVE-2025-8088 WinRAR DLL sideloading patterns and known GIFTEDCROOK/BeautyStealer payload delivery indicators to detect and block malicious archive-based exploitation at the network perimeter before execution reaches the endpoint.
- • Enforce Egress Security & Policy Enforcement with FQDN-based filtering to block unauthorized outbound connections to Telegram bot APIs and unknown FastAPI C2 endpoints; restrict application-to-internet traffic to approved destinations only, directly disrupting BeautyStealer and Prime ReverseShell C2 and exfiltration channels.
- • Apply Multicloud Visibility & Control to baseline outbound traffic patterns from endpoints and workloads, enabling anomaly detection against unusual data compression events, bulk file access across Office/KeePass/RDP/VPN file types, and high-volume outbound transfers to cloud messaging platforms indicative of stealer activity.
- • Implement Zero Trust Segmentation with identity-based least-privilege policies to ensure that even if an endpoint is compromised, lateral access to VPN configuration stores, RDP credential repositories, and sensitive document shares is denied without explicit policy authorization — limiting the blast radius of credential harvesting.
- • Enable Encrypted Traffic controls (HPE/IPsec) for sensitive internal circuits and enforce inspection of outbound encrypted sessions via Cloud Firewall (ACF) with URL filtering to detect and prevent covert exfiltration over HTTPS to Telegram or unknown SaaS infrastructure, ensuring stolen data cannot leave the environment undetected.
