Changed since version 2

• Added S2 (The Record, 2026-11-04) as corroborating reporting to the timeline and to the triage reasoning. [S2]
• Kept triage at P2 despite the story's automated P1 raise, because no source reports targeting outside Ukraine or CIS. [S2][S3]

What happened

• ESET reports that Gorbag, a Russia-aligned actor overlapping CERT-UA's UAC-0226, spearphishes Ukrainian law enforcement, local government and defense entities. [S3]
• Since early 2026, Gorbag has sent RAR archives that exploit CVE-2025-8088. The archive shows a decoy PDF while it drops a Startup-folder LNK, an encrypted payload and a PowerShell loader in %ProgramData%. [S3]
• Earlier Gorbag chains used XLSM macros that dropped BeautyStealer into %ProgramData% and ran it. [S3]
• BeautyStealer takes browser credentials and cookies, VPN configs and documents. It exfiltrates them via Telegram sendDocument or a FastAPI C2, then deletes itself. [S3]
• Cisco Talos reports that Silent Lynx (UAT-6275) used a CVE-2025-8088 RAR to drop PickleShell into the Startup folder against CIS governments. [S5][S4]

Timeline

Detect

WinRAR writes into a Startup folder · Sysmon EID 11 / EDR file creation events

index=* EventCode=11 Image="*\\WinRAR.exe" TargetFilename="*\\Start Menu\\Programs\\Startup\\*" | stats count min(_time) as first max(_time) as last values(TargetFilename) by host User

FROM logs-* | WHERE event.code == "11" AND ENDS_WITH(TO_LOWER(process.executable), "\\winrar.exe") AND TO_LOWER(file.path) LIKE "*\\start menu\\programs\\startup\\*" | STATS count = COUNT(*), first = MIN(@timestamp), last = MAX(@timestamp), files = VALUES(file.path) BY host.name, user.name

A hit means: An archive extraction placed a file in a Startup folder. This matches the CVE-2025-8088 persistence step reported for Gorbag (LNK) and Silent Lynx (PickleShell). [S3][S5]

PowerShell launched by explorer.exe at logon, running from ProgramData · Sysmon EID 1 / Windows 4688 / EDR process events

index=* EventCode=1 ParentImage="*\\explorer.exe" Image="*\\powershell.exe" CommandLine="*ProgramData*" | stats count min(_time) as first values(CommandLine) by host User

FROM logs-* | WHERE event.code == "1" AND ENDS_WITH(TO_LOWER(process.parent.executable), "\\explorer.exe") AND ENDS_WITH(TO_LOWER(process.executable), "\\powershell.exe") AND TO_LOWER(process.command_line) LIKE "*programdata*" | STATS count = COUNT(*), first = MIN(@timestamp), command_lines = VALUES(process.command_line) BY host.name, user.name

A hit means: A Startup LNK likely triggered a PowerShell loader stored in %ProgramData%. This matches the Gorbag persistence chain. [S3]

Excel launches an executable from ProgramData · Sysmon EID 1 / Windows 4688 / EDR process events

index=* EventCode=1 ParentImage="*\\EXCEL.EXE" Image="C:\\ProgramData\\*" | stats count values(CommandLine) values(Image) by host User ParentImage

FROM logs-* | WHERE event.code == "1" AND ENDS_WITH(TO_LOWER(process.parent.executable), "\\excel.exe") AND STARTS_WITH(TO_LOWER(process.executable), "c:\\programdata\\") | STATS count = COUNT(*), command_lines = VALUES(process.command_line), images = VALUES(process.executable) BY host.name, user.name, process.parent.executable

A hit means: An Excel macro dropped and ran a binary from %ProgramData%. This matches the Gorbag XLSM chain that delivers BeautyStealer. [S3]

Telegram Bot API traffic from non-browser processes, plus story IoCs · Web proxy / Sysmon EID 3 and 22 / firewall / EDR

index=* ((url="*api.telegram.org/bot*/sendDocument*" OR QueryName="api.telegram.org") OR DestinationIp IN ("89.44.9.186","142.111.194.73") OR dest_ip IN ("89.44.9.186","142.111.194.73") OR Hashes="*0589d2079fbef814dc7bb95c4b3b555c8b933af6*" OR Hashes="*c17369b4b49113d07f080df832e218156fb0940f*" OR Hashes="*a5e0a82bf6cc302a20d917235643b748f73fcc27*" OR Hashes="*e27e0d0a4b308f9b6b0469159931eb5e343e7ff8*") NOT Image IN ("*\\chrome.exe","*\\msedge.exe","*\\firefox.exe","*\\Telegram.exe") | stats count values(Image) values(url) by host src user dest_ip

A hit means: A non-browser process reached the Telegram API or a listed indicator. A sendDocument upload or an IoC match is consistent with BeautyStealer exfiltration. [S3]

Verify

• Confirm the Startup-folder file arrived during a WinRAR extraction of an emailed RAR, with a decoy PDF opening at the same time. [S3]
• Look for an encrypted payload and a PowerShell loader written to %ProgramData% in the same session. [S3]
• A missing stealer binary does not prove a host is clean, because BeautyStealer self-deletes. Newer versions use API calls rather than BAT scripts to do it, so rely on process, file and network history. [S3]
• Benign look-alikes: users or installers placing shortcuts in Startup; legitimate Excel add-ins in ProgramData; sanctioned Telegram clients; IT tools packaged with PS2EXE.
• Lure file names seen include 'Повідомлення 4726-49.rar' and 'додаток податкова.xlsm'. [S3]

Scope

Affected

• Windows hosts running WinRAR vulnerable to CVE-2025-8088 [S3][S5]
• Hosts where users open XLSM attachments with macros allowed (Gorbag 2025 chain) [S3]

Only if

• A user opens a weaponized RAR with a vulnerable WinRAR [S3]
• Macros are allowed to run, for the XLSM chain [S3]

Not affected if

• WinRAR is patched for CVE-2025-8088

Enumerate

• All WinRAR installs and their versions, including portable copies
• Hosts with new Startup-folder LNK or script files since February 2025
• PowerShell scripts and encrypted blobs in %ProgramData% on hit hosts [S3]
• Browser credentials, cookies, .ovpn, .kdbx, .pfx and .rdp files on hit hosts [S3]
• Scheduled tasks created by PS2EXE-packaged executables [S5]

Contain

• Block the listed IPs, and block api.telegram.org uploads from non-sanctioned processes.
• Isolate hit hosts through EDR. Keep them powered on to preserve memory and the file timeline.
• Quarantine inbound external RAR and XLSM attachments pending review.
• Revoke sessions and reset credentials, VPN configs and certificates exposed on hit hosts. Exfiltrated data cannot be recalled.

Eradicate

• Remove the Startup-folder LNKs and the %ProgramData% loader and encrypted payload. [S3]
• Remove scheduled tasks and Startup items tied to the Silent Lynx chains. [S5]
• Update WinRAR on all hosts to remove the root cause.

Recover

• Before reconnecting a host, confirm WinRAR is patched and the Startup folders and %ProgramData% are clean.
• Re-issue VPN configurations and certificates exposed on affected hosts. [S3]
• Monitor affected accounts for new-location logins, and monitor hosts for repeat Telegram API traffic.

Re-enter the loop when

• A hunt hits outside Ukraine or CIS targeting, or a sector such as finance is named.
• New IoCs, or new C2 details for the FastAPI server, are published.
• A third actor is reported exploiting CVE-2025-8088.
• RARLAB or CERT-UA updates its advisory or fixed-version guidance.

Debrief

• Record WinRAR patch coverage and how long vulnerable versions persisted.
• Record whether Startup-folder and process telemetry existed and was retained.
• Gap: the sources do not state the fixed WinRAR version.
• Gap: the FastAPI C2 details beyond the listed IPs are not given.
• Gap: the sources do not map each IoC to a specific chain.

Detection coverage — checked automatically

Checked automatically 2026-11-10 18:12Z from public sources: 18 published, 18 nothing found, 0 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

Where each CVE comes from: CVE-2025-8088 — UAT-6275 (Silent Lynx / TAG-193) targets CIS government organizations with macro, PS2EXE, GitHub PowerShell and CVE-2025; CVE-2025-25257 — Silent Lynx (UAT-6275) uses macro docs, PS2EXE, GitHub PowerShell and WinRAR CVE-2025-8088 to deploy reverse shells agai. A product row answers "is the software from that story reachable from the internet", not "is this card about that software".

vuln:CVE-2025-8088

vuln:CVE-2025-25257

cpe:"cpe:/a:rarlab:winrar"

product:"Winrar"

host.services: (software.product = "Winrar")

Internet-wide count, trend

Shodan's count of matching services on the whole internet, one point a day; the scope (your ranges) is never part of it. A count moves with Shodan's crawl as much as with patching, so read the direction, not the digit.

NVD names 2 more affected products (libraries and embedders); the CVE query covers them where Shodan has fingerprinted the version.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-11-10 18:12Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

• The source for CVE-2025-25257 (FortiWeb) in the thread is unclear. No story ties it to these actors.
• Is The Record [S2] adding anything beyond ESET's findings?
• Today's story was raised to P1 by a rule, yet targeting is Ukraine-specific. Should the analyst confirm P2 for a financial-sector reader?

Sources

• [S1] https://thehackernews.com/2026/11/russia-aligned-gorbag-hackers-exploit.html · The Hacker News
• [S2] https://therecord.media/russia-linked-cyber-spies-target-ukraine-war-support · The Record
• [S3] https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/ · ESET (welivesecurity.com)
• [S4] https://thehackernews.com/2026/10/silent-lynx-exploits-winrar-flaw-to.html · The Hacker News
• [S5] https://blog.talosintelligence.com/break-the-silence-kazakhstan-nexus-uat-6275-targets-cis-government-organizations/ · Cisco Talos

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically; a dismissed draft unpublishes it.