Search — “CVE-2025-8088”

ESET reports Gorbag, a Russia-aligned actor overlapping with CERT-UA's UAC-0226, targeting Ukrainian law enforcement, local government and defense entities via spearphishing. Since early 2026 it delivers RAR archives exploiting CVE-2025-8088 that show a decoy PDF while dropping a Startup-folder LNK, an encrypted payload and a PowerShell loader in %ProgramData%; earlier chains used XLSM macros dropping BeautyStealer into %ProgramData%. BeautyStealer harvests browser credentials/cookies, VPN configs and documents, exfiltrates via Telegram sendDocument or a FastAPI C2, then self-deletes. Hunt for WinRAR writing LNKs into Startup, PowerShell loaders in %ProgramData%, and Telegram API traffic from non-browser processes.

ESET reports Gorbag (overlaps UAC-0226 / SHADOW-EARTH-066), active since February 2025, spearphishes Ukrainian law enforcement, local administrations and defense entities. Throughout 2025 it used XLSM macro lures that drop BeautyStealer into %ProgramData%. In early 2026 it switched to RAR archives exploiting CVE-2025-8088, which drop a Startup-folder LNK plus a PowerShell loader. BeautyStealer harvests browser data, VPN configs and documents, exfiltrates them via Telegram sendDocument or a FastAPI C2, then deletes itself. Hunt for WinRAR writing LNKs to Startup, Office spawning executables from ProgramData, and Telegram API uploads.

Cisco Talos and Recorded Future Insikt Group report Kazakhstan-nexus (medium confidence) actor UAT-6275 targeting government bodies across CIS countries from June 2025 through August 2026, with interest in water and energy-related entities. Four infection chains use macro Word documents, PS2EXE downloaders creating scheduled tasks, GitHub-hosted PowerShell that provides remote shell access, and a RAR archive exploiting CVE-2025-8088 to place PickleShell in the Startup folder. Hunters should look for unexpected PowerShell fetching payloads from GitHub, new scheduled tasks, and Startup-folder changes.

Silent Lynx, tracked by Cisco Talos as UAT-6275 and by Recorded Future as TAG-193, ran four infection chains against CIS government organizations from June 2025 to August 2026. Chains used macro-enabled Word documents, PS2EXE downloaders that create scheduled tasks, LNK files in RAR archives launching PowerShell that fetches a GitHub-hosted script, and a RAR exploiting CVE-2025-8088 to drop PickleShell into the Windows Startup folder. Hunters should look for PowerShell or LNK-launched interpreters fetching from GitHub, new scheduled tasks created by PS2EXE-packaged executables, and new files in Startup folders.

Cisco Talos (UAT-6275) and Recorded Future Insikt Group (TAG-193) report at least eight campaigns since January 2025 against government agencies in nine countries, with medium-confidence ties to Kazakhstan. The group typically sends phishing emails with malicious attachments, sometimes from compromised government accounts, and in April 2026 exploited WinRAR CVE-2025-8088 to place malware in a Windows Startup folder. Hunters should look for WinRAR-extracted files written to Startup folders and for malicious scripts or files staged on GitHub.