Changed since version 1

• Sources renumbered: ESET is now S3, THN Silent Lynx is S4, Talos is S5. The Record was added as S2.
• Added the vendor-stated behavior that the Startup LNK launches the PowerShell loader at logon, plus a matching hunt. [S3]
• Merged the IoC sweep into the Telegram hunt and excluded browser processes. [S3]
• Added credential and VPN file types (.ovpn, .kdbx, .pfx, .rdp) to scope enumeration. [S3]
• Added the self-delete change from BAT scripts to API calls to Verify. [S3]
• Added Eradicate, Re-enter, coverage checks and the 2026-11-04 timeline entry. [S2]
• Flagged CVE-2025-25257 as possibly mis-tagged.

What happened

• ESET reports Gorbag, a Russia-aligned actor overlapping CERT-UA's UAC-0226, spearphishing Ukrainian law enforcement, local government and defense entities. [S3]
• Since early 2026, Gorbag RAR archives exploit CVE-2025-8088. They show a decoy PDF while dropping a Startup-folder LNK, an encrypted payload and a PowerShell loader. [S3]
• The LNK runs the loader at each later startup. Earlier, throughout 2025, XLSM macros dropped BeautyStealer into %ProgramData% and executed it. [S3]
• BeautyStealer takes browser cookies, passwords and local state, VPN configs and documents. It exfiltrates them via Telegram sendDocument or a custom C2, then self-deletes. [S3]
• Talos reports Silent Lynx (UAT-6275) also used a CVE-2025-8088 RAR to drop PickleShell into the Startup folder, against CIS government targets. [S5][S4]

Timeline

Detect

WinRAR writes into a Startup folder · Sysmon EID 11 / EDR file creation events

index=* EventCode=11 Image="*\\WinRAR.exe" TargetFilename="*\\Start Menu\\Programs\\Startup\\*" | stats count min(_time) as first max(_time) as last values(TargetFilename) by host User

A hit means: An archive extraction placed a file in a Startup folder. This matches the CVE-2025-8088 persistence step reported for Gorbag (LNK) and Silent Lynx (PickleShell). [S3][S5]

PowerShell launched by explorer.exe at logon, running from ProgramData · Sysmon EID 1 / Windows 4688 / EDR process events

index=* EventCode=1 ParentImage="*\\explorer.exe" Image="*\\powershell.exe" CommandLine="*ProgramData*" | stats count min(_time) as first values(CommandLine) by host User

A hit means: A Startup LNK likely triggered a PowerShell loader stored in %ProgramData%. This matches the Gorbag persistence chain. [S3]

Excel launches an executable from ProgramData · Sysmon EID 1 / Windows 4688 / EDR process events

index=* EventCode=1 ParentImage="*\\EXCEL.EXE" Image="C:\\ProgramData\\*" | stats count values(CommandLine) values(Image) by host User ParentImage

A hit means: An Excel macro dropped and ran a binary from %ProgramData%. This matches the Gorbag XLSM chain that delivers BeautyStealer. [S3]

Telegram Bot API traffic from non-browser processes, plus story IoCs · Web proxy / Sysmon EID 3 and 22 / firewall / EDR

index=* ((url="*api.telegram.org/bot*/sendDocument*" OR QueryName="api.telegram.org") OR DestinationIp IN ("89.44.9.186","142.111.194.73") OR dest_ip IN ("89.44.9.186","142.111.194.73") OR Hashes="*0589d2079fbef814dc7bb95c4b3b555c8b933af6*" OR Hashes="*c17369b4b49113d07f080df832e218156fb0940f*" OR Hashes="*a5e0a82bf6cc302a20d917235643b748f73fcc27*" OR Hashes="*e27e0d0a4b308f9b6b0469159931eb5e343e7ff8*") NOT Image IN ("*\\chrome.exe","*\\msedge.exe","*\\firefox.exe","*\\Telegram.exe") | stats count values(Image) values(url) by host src user dest_ip

A hit means: A non-browser process reached the Telegram API or a listed indicator. A sendDocument upload or an IoC match is consistent with BeautyStealer exfiltration. [S3]

Verify

• Confirm the Startup-folder file arrived during a WinRAR extraction of an emailed RAR, with a decoy PDF opening at the same time. [S3]
• Look for an encrypted payload and a PowerShell loader written to %ProgramData% in the same session. [S3]
• A missing stealer binary does not prove a host is clean, because BeautyStealer self-deletes. Newer versions use API calls rather than BAT scripts to do it, so rely on process, file and network history. [S3]
• Benign look-alikes: users or installers placing shortcuts in Startup; legitimate Excel add-ins in ProgramData; sanctioned Telegram clients; IT tools packaged with PS2EXE.
• Lure file names seen include 'Повідомлення 4726-49.rar' and 'додаток податкова.xlsm'. [S3]

Scope

Affected

• Windows hosts running WinRAR vulnerable to CVE-2025-8088 [S3][S5]
• Hosts where users open XLSM attachments with macros allowed (Gorbag 2025 chain) [S3]

Only if

• A user opens a weaponized RAR with a vulnerable WinRAR [S3]
• Macros are allowed to run, for the XLSM chain [S3]

Not affected if

• WinRAR is patched for CVE-2025-8088

Enumerate

• All WinRAR installs and their versions, including portable copies
• Hosts with new Startup-folder LNK or script files since February 2025
• PowerShell scripts and encrypted blobs in %ProgramData% on hit hosts [S3]
• Browser credentials, cookies, .ovpn, .kdbx, .pfx and .rdp files on hit hosts [S3]
• Scheduled tasks created by PS2EXE-packaged executables [S5]

Contain

• Block the listed IPs, and block api.telegram.org uploads from non-sanctioned processes.
• Isolate hit hosts through EDR. Keep them powered on to preserve memory and the file timeline.
• Quarantine inbound external RAR and XLSM attachments pending review.
• Revoke sessions and reset credentials, VPN configs and certificates exposed on hit hosts. Exfiltrated data cannot be recalled.

Eradicate

• Remove the Startup-folder LNK, the PowerShell loader and the encrypted payload in %ProgramData%. [S3]
• Remove PickleShell from Startup folders and delete rogue scheduled tasks. [S5]
• Patch WinRAR to remove the root cause.

Recover

• Before reconnecting a host, confirm WinRAR is patched and the Startup folders and %ProgramData% are clean.
• Re-issue VPN configurations and certificates exposed on affected hosts. [S3]
• Monitor affected accounts for new-location logins, and monitor hosts for repeat Telegram API traffic.

Re-enter the loop when

• ESET, CERT-UA or Talos publish new IoCs or C2 endpoints
• A report shows either actor targeting the financial sector or regions outside Ukraine and the CIS
• Another actor is reported exploiting CVE-2025-8088
• RARLAB changes its advisory or reports a patch bypass

Debrief

• Record WinRAR patch coverage and how long vulnerable versions persisted.
• Record whether Startup-folder and process telemetry existed and was retained.
• Gap: the sources do not state the fixed WinRAR version.
• Gap: the FastAPI C2 details beyond the listed IPs are not given.
• Gap: the sources do not map each IoC to a specific chain.

Detection coverage — checked automatically

Checked automatically 2026-11-04 12:54Z from public sources: 18 published, 18 nothing found, 0 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

vuln:CVE-2025-8088

vuln:CVE-2025-25257

cpe:"cpe:/a:rarlab:winrar"

product:"Winrar"

host.services: (software.product = "Winrar")

cpe:"cpe:/a:dtsearch:dtsearch"

product:"Dtsearch"

host.services: (software.product = "Dtsearch")

cpe:"cpe:/a:fortinet:fortiweb"

product:"Fortiweb"

host.services: (software.product = "Fortiweb")

http.title:"FortiWeb"

Internet-wide count, trend

Shodan's count of matching services on the whole internet, one point a day; the scope (your ranges) is never part of it. A count moves with Shodan's crawl as much as with patching, so read the direction, not the digit.

Banner spellings: a model read 3 from the NVD names and this card's text (former and marketing names, console titles); 1 matched something on Shodan and is shown above, the rest were dropped.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-11-04 12:54Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

• The prior draft and the 2026-10-16 story list CVE-2025-25257, a FortiWeb flaw. No source ties it to either campaign; was it tagged in error?
• Which two IoCs are new today? The input does not say.
• The story tag says P1, but the card keeps P2 because targeting is not financial. The analyst should confirm the priority.
• What is the exact fixed WinRAR version? The exposure note says only 'patched July 2025' and gives no source.

Sources

• [S1] https://thehackernews.com/2026/11/russia-aligned-gorbag-hackers-exploit.html · The Hacker News
• [S2] https://therecord.media/russia-linked-cyber-spies-target-ukraine-war-support · The Record
• [S3] https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/ · ESET (welivesecurity.com)
• [S4] https://thehackernews.com/2026/10/silent-lynx-exploits-winrar-flaw-to.html · The Hacker News
• [S5] https://blog.talosintelligence.com/break-the-silence-kazakhstan-nexus-uat-6275-targets-cis-government-organizations/ · Cisco Talos

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically once it crosses the publish bar.