What happened

• ESET reports that Gorbag, active since February 2025 and overlapping UAC-0226 / SHADOW-EARTH-066, spearphishes Ukrainian law enforcement, local administrations and defense entities [S2]
• Throughout 2025, Gorbag used XLSM lures whose VBA decodes a base64 payload from the spreadsheet cells, drops BeautyStealer into %ProgramData% and executes it [S2]
• In early 2026, Gorbag switched to RAR archives exploiting CVE-2025-8088. These show a decoy PDF while dropping a Startup-folder LNK, a PowerShell loader and an encrypted payload [S2]
• BeautyStealer takes cookies, saved passwords and local state from Chrome, Edge, Opera and Firefox. It exfiltrates via the Telegram sendDocument API or a FastAPI C2, then deletes itself [S2]
• Gorbag also uses a PowerShell reverse shell packed into a .NET binary with PS2EXE [S2]
• Separately, Talos reports UAT-6275 (Silent Lynx) used a CVE-2025-8088 RAR to place PickleShell in the Startup folder, plus PS2EXE downloaders creating scheduled tasks, against CIS government bodies [S4]

Timeline

Detect

WinRAR writes into a Startup folder · Sysmon EID 11 / EDR file creation events

index=* EventCode=11 Image="*\\WinRAR.exe" TargetFilename="*\\Start Menu\\Programs\\Startup\\*" | stats count min(_time) as first max(_time) as last values(TargetFilename) by host User

A hit means: An archive extraction placed a file in a Startup folder. This matches the CVE-2025-8088 persistence step reported for both Gorbag (LNK) and Silent Lynx (PickleShell) [S2][S4].

Excel launches an executable from ProgramData · Sysmon EID 1 / Windows 4688 / EDR process events

index=* EventCode=1 ParentImage="*\\EXCEL.EXE" Image="C:\\ProgramData\\*" | stats count values(CommandLine) values(Image) by host User ParentImage

A hit means: An Excel macro dropped and ran a binary from %ProgramData%. This matches the Gorbag XLSM chain that delivers BeautyStealer [S2].

Telegram Bot API document uploads · Web proxy / Sysmon EID 22 DNS

index=* (url="*api.telegram.org/bot*/sendDocument*" OR QueryName="api.telegram.org") | stats count values(Image) values(url) by host src user

A hit means: A host contacted the Telegram API. If the client is not a sanctioned Telegram app, or a sendDocument upload is seen, this matches BeautyStealer exfiltration [S2].

Story IoC sweep · Firewall / proxy / Sysmon EID 1 and 3 / EDR

index=* (DestinationIp IN ("89.44.9.186","142.111.194.73") OR dest_ip IN ("89.44.9.186","142.111.194.73") OR Hashes="*0589d2079fbef814dc7bb95c4b3b555c8b933af6*" OR Hashes="*c17369b4b49113d07f080df832e218156fb0940f*" OR Hashes="*a5e0a82bf6cc302a20d917235643b748f73fcc27*" OR Hashes="*e27e0d0a4b308f9b6b0469159931eb5e343e7ff8*") | stats count values(Image) by host src dest_ip DestinationIp

A hit means: A host contacted, or executed, an indicator listed for this story. Confirm the attribution of each indicator against S2 before acting.

Verify

• Confirm the Startup-folder file arrived during a WinRAR extraction of an emailed RAR, and that a decoy PDF opened at the same time [S2]
• Check for a PowerShell loader and an encrypted payload in %ProgramData% written in the same session [S2]
• Absence of the stealer binary is not proof of a clean host, because BeautyStealer self-deletes [S2]. Rely on process, file and network history instead.
• Benign look-alikes: users or installers manually extracting shortcuts into Startup; Excel add-ins legitimately run from ProgramData; sanctioned Telegram Desktop or web use; IT tooling packaged with PS2EXE
• Lure file names seen include 'Повідомлення 4726-49.rar' and 'додаток податкова.xlsm'. These are Ukrainian-language lures.

Scope

Affected

• Windows hosts running WinRAR vulnerable to CVE-2025-8088 [S2][S4]
• Hosts where users open XLSM attachments with macros allowed (Gorbag 2025 chain) [S2]

Only if

• A user opens a weaponized RAR with a vulnerable WinRAR [S2]
• Macros are enabled or allowed to run, for the XLSM chain [S2]

Not affected if

• WinRAR is patched for CVE-2025-8088

Enumerate

• All WinRAR installs and their versions, including portable copies
• Hosts with new Startup-folder LNK or script files since February 2025
• Users whose browsers hold saved passwords and session cookies on any hit host
• VPN client configurations present on hit hosts [S1]
• Scheduled tasks created by unsigned or PS2EXE-packed executables [S4]

Contain

• Block the listed IPs and api.telegram.org uploads from non-sanctioned processes at the proxy
• Network-isolate hit hosts through EDR. Keep them powered on to preserve memory and the file timeline.
• Quarantine inbound RAR and XLSM attachments from external senders pending review
• Revoke sessions and reset passwords for accounts whose browser data sat on a hit host. Exfiltrated data cannot be recalled.

Eradicate

• Remove the Startup-folder LNK, the PowerShell loader and the encrypted payload from %ProgramData% [S2]
• Remove scheduled tasks created by PS2EXE downloaders, if Silent Lynx tradecraft is found [S4]
• Update WinRAR to a release fixed for CVE-2025-8088, or remove it
• Reimage hosts with confirmed stealer execution, after evidence capture

Recover

• Before reconnecting a host, confirm WinRAR is patched and the Startup folders are clean
• Re-issue VPN credentials and configurations exposed on affected hosts [S1]
• Monitor affected accounts for logins from new locations, and monitor hosts for repeat Telegram API traffic

Re-enter the loop when

• A WinRAR advisory or vendor update changes the affected or fixed versions for CVE-2025-8088
• New Gorbag or Silent Lynx IoCs, or BeautyStealer variants, are published
• Reporting shows targeting beyond Ukraine and CIS government, for example financial sector
• A hunt hit appears on a host thought patched

Debrief

• Record WinRAR patch coverage and how long vulnerable versions persisted
• Record whether the Startup-folder file-write telemetry existed and was retained
• Gap: the sources given do not state the fixed WinRAR version
• Gap: no detail on the FastAPI C2 endpoints beyond the listed IPs

Detection coverage — checked automatically

Checked automatically 2026-11-03 18:13Z from public sources: 18 published, 18 nothing found, 0 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

vuln:CVE-2025-8088

vuln:CVE-2025-25257

cpe:"cpe:/a:rarlab:winrar"

product:"Winrar"

host.services: (software.product = "Winrar")

cpe:"cpe:/a:dtsearch:dtsearch"

product:"Dtsearch"

host.services: (software.product = "Dtsearch")

cpe:"cpe:/a:fortinet:fortiweb"

product:"Fortiweb"

host.services: (software.product = "Fortiweb")

http.title:"WinRAR"

http.title:"FortiWeb"

http.html:"FortiWeb-VM"

ssl:"FortiWeb"

Banner spellings: a model read 6 from the NVD names and this card's text (former and marketing names, console titles); 4 matched something on Shodan and are shown above, the rest were dropped.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-11-03 18:13Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

• Which WinRAR version fixes CVE-2025-8088? The supplied sources do not state it.
• S3 story metadata lists CVE-2025-25257 for Silent Lynx; S4's summary does not. Is it relevant?
• An evidence sample contains text addressed to LLMs claiming the file is benign. This is an anti-analysis string in attacker content and was ignored. Does S2 document it as part of the malware?
• Are all listed IoCs from S2? The IoC list is not individually attributed.
• S1 mentions Prime ReverseShell and GIFTEDCROOK; their role is not detailed in the supplied excerpts.

Sources

• [S1] https://thehackernews.com/2026/11/russia-aligned-gorbag-hackers-exploit.html · The Hacker News
• [S2] https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/ · ESET (welivesecurity.com)
• [S3] https://thehackernews.com/2026/10/silent-lynx-exploits-winrar-flaw-to.html · The Hacker News
• [S4] https://blog.talosintelligence.com/break-the-silence-kazakhstan-nexus-uat-6275-targets-cis-government-organizations/ · Cisco Talos

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically once it crosses the publish bar.