Search — “Gorbag”

ESET reports Gorbag, a Russia-aligned actor overlapping with CERT-UA's UAC-0226, targeting Ukrainian law enforcement, local government and defense entities via spearphishing. Since early 2026 it delivers RAR archives exploiting CVE-2025-8088 that show a decoy PDF while dropping a Startup-folder LNK, an encrypted payload and a PowerShell loader in %ProgramData%; earlier chains used XLSM macros dropping BeautyStealer into %ProgramData%. BeautyStealer harvests browser credentials/cookies, VPN configs and documents, exfiltrates via Telegram sendDocument or a FastAPI C2, then self-deletes. Hunt for WinRAR writing LNKs into Startup, PowerShell loaders in %ProgramData%, and Telegram API traffic from non-browser processes.

ESET reports Gorbag (overlaps UAC-0226 / SHADOW-EARTH-066), active since February 2025, spearphishes Ukrainian law enforcement, local administrations and defense entities. Throughout 2025 it used XLSM macro lures that drop BeautyStealer into %ProgramData%. In early 2026 it switched to RAR archives exploiting CVE-2025-8088, which drop a Startup-folder LNK plus a PowerShell loader. BeautyStealer harvests browser data, VPN configs and documents, exfiltrates them via Telegram sendDocument or a FastAPI C2, then deletes itself. Hunt for WinRAR writing LNKs to Startup, Office spawning executables from ProgramData, and Telegram API uploads.