Gorbag / UAC-0226 / SHADOW-EARTH-066: WinRAR flaw exploited to deploy GIFTEDCROOK & BeautyStealer stealers against Ukrainian orgs (CVE-2025-8088)
Severity: medium · Patch status: patched · Since 2026-11-03 · CVE-2025-8088
ESET reports a Russia-aligned threat actor tracked as Gorbag (CERT-UA: UAC-0226; Trend Micro: SHADOW-EARTH-066), active since at least February 2025, targeting Ukrainian law enforcement, frontline local administrations, and defense-sector organizations. Attacks use spear-phishing with government-themed lures (fines, taxes), a macro-enabled Excel file running VBA, and exploitation of the patched WinRAR path-traversal flaw CVE-2025-8088 via DLL sideloading to deploy GIFTEDCROOK and BeautyStealer infostealers. The stealers harvest browser credentials, cookies, history, VPN/RDP and OpenVPN configurations, Office documents, archives, and KeePass databases, exfiltrating data to Telegram or a FastAPI C2, then self-deleting. Early waves used Prime ReverseShell, which embeds a prompt-injection comment attempting to fool AI-based analysis. ESET suggests Gorbag may act as an initial access broker. WinRAR flaw is patched; phishing remains the primary vector.
What to do
- Patch WinRAR to a version fixing CVE-2025-8088 on all endpoints
- Warn staff about government-themed phishing attachments, especially macro-enabled Office files
- Block or restrict macro execution via policy (e.g., mark-of-the-web enforcement)
- Monitor for suspicious archive uploads to Telegram and unusual FastAPI C2 traffic
- Rotate credentials and VPN/RDP secrets on potentially affected hosts; review KeePass database access
Fixed versions
Sources
All live incidents on Threat Watch
