Gorbag Turns a WinRAR Bug on Ukraine’s Police and Front-Line Councils

A Russia-aligned crew that ESET calls Gorbag has been stealing from Ukrainian police, courts, front-line city councils and defense firms since February 2025, and this year it swapped Excel macros for a WinRAR bug. ESET’s research, covered by The Hacker News, ties the group to the activity CERT-UA tracks as UAC-0226 and Trend Micro as SHADOW-EARTH-066. Its main tool, BeautyStealer, grabs browser logins, VPN profiles, password vaults and Ukrainian digital-signature keys, sends them home and deletes itself.

89.44.9[.]186 (Prime ReverseShell C2, first seen 2025-03-28)
142.111.194[.]73 (BeautyStealer exfiltration server, first seen 2026-06-02)

додаток податкова.xlsm (XLSM lure) SHA1 E27E0D0A4B308F9B6B0469159931EB5E343E7FF8
Повідомлення 4726-49.rar (CVE-2025-8088 archive) SHA1 0589D2079FBEF814DC7BB95C4B3B555C8B933AF6
Prime ReverseShell (“Windows Telemetry”) SHA1 A5E0A82BF6CC302A20D917235643B748F73FCC27
Spearphishing email SHA1 C17369B4B49113D07F080DF832E218156FB0940F

Source article: Gorbag: Orcs on the border, harvesting intelligence in Ukraine
Publisher: ESET Research, WeLiveSecurity (Damien Schaeffer)
Published: November 2026
URL: https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/

Executive Summary

ESET tracks Gorbag, a Russia-aligned espionage group active since at least February 2025 that CERT-UA reports as UAC-0226 and Trend Micro as SHADOW-EARTH-066, and which has focused exclusively on Ukrainian targets: law enforcement and justice bodies, local administrations near the front line, defense-sector organizations and a documented transport hub for foreign military aid. Lures arrive from previously compromised Ukrainian government mailboxes on themes such as administrative fines and taxes. Through 2025 the attachment was a macro-enabled XLSM whose VBA decoded a Base64 payload stored in worksheet cells into %ProgramData% and ran it; from early 2026 it is a RAR archive exploiting the WinRAR alternate-data-stream path traversal CVE-2025-8088, which displays a decoy PDF, drops an encrypted payload and a PowerShell loader into %ProgramData% and plants an LNK in the Startup folder for persistence. Early waves used Prime ReverseShell, a PS2EXE-packed PowerShell reverse shell derived from the public PSSW100AVB project, talking HTTPS to 89.44.9[.]186; since then the group relies on BeautyStealer, a C++ stealer (versions 0.9 to 2.0) that collects browser cookies, passwords and history from Chrome, Edge, Opera and Firefox, OpenVPN configurations, and documents, archives, KeePass databases, RDP files, certificates and .zs2 signature keys from user folders, removable media and mapped drives, then exfiltrates through the Telegram sendDocument API (to v1.1) or a FastAPI server at 142.111.194[.]73 (v1.2 onward, RC4-encrypted in v2.0) and deletes itself. The objective is intelligence collection aligned with Russian wartime priorities, possibly with onward handoff of VPN access to other actors, which ESET has not confirmed. Hunt leads, false positive expectations and indicators are detailed below; the source published no YARA or Sigma rules.

ATT&CK chain: Resource Development → Initial Access → Execution → Persistence → Defense Evasion → Credential Access → Collection → Command and Control → Exfiltration

Hunt Lead Grid

Gorbag Infrastructure and Lure Sweep

ESET publishes two network indicators: 89.44.9[.]186 at M247 Europe SRL, the Prime ReverseShell command-and-control server first seen March 28, 2025, and 142.111.194[.]73 at EGIHosting, the BeautyStealer exfiltration server first seen June 2, 2026. File indicators are the spearphishing email (SHA-1 C17369B4B49113D07F080DF832E218156FB0940F), the XLSM lure додаток податкова.xlsm (E27E0D0A4B308F9B6B0469159931EB5E343E7FF8), the CVE-2025-8088 archive Повідомлення 4726-49.rar (0589D2079FBEF814DC7BB95C4B3B555C8B933AF6) and Prime ReverseShell, which presents itself as “Windows Telemetry” (A5E0A82BF6CC302A20D917235643B748F73FCC27). Lures came from real, previously compromised Ukrainian government mailboxes, so sender reputation won’t catch them. The detection logic is a retrospective sweep of firewall, proxy and NetFlow logs for either IP, mail-gateway and EDR file telemetry for the four SHA-1s and the two Cyrillic attachment names, and a search for any process whose file description is “Windows Telemetry” running from outside System32.

Use mail gateway logs, EDR file and network telemetry, and perimeter flow logs, and sweep back to February 2025 for the reverse-shell IP and to June 2026 for the exfiltration IP, since BeautyStealer deletes itself and leaves little on disk afterwards. Scope first to Ukrainian public-sector, justice, municipal and defense organizations and to anyone who exchanges mail with them, because the group reuses compromised accounts to reach new victims. Don’t block the hosting providers’ whole ranges, which carry unrelated customers; block the two IPs. A hit on the exfiltration IP means data has already left: escalate to incident response, assume browser sessions, VPN profiles and signing keys on that host are compromised, and notify the key issuer to revoke .zs2 keys.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Initial Access → T1566.001 (Phishing: Spearphishing Attachment); Command and Control → T1071.001 (Application Layer Protocol: Web Protocols) (mapping per source article)

Sources: “Gorbag: Orcs on the border, harvesting intelligence in Ukraine”, ESET Research, Nov. 2026, https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/ (source article)

Archive Extraction Writing Into the Startup Folder

CVE-2025-8088 lets a crafted RAR use alternate data streams with path traversal so that, when a vulnerable WinRAR extracts it, files land outside the folder the user picked. In Gorbag’s 2026 chain the victim opens Повідомлення 4726-49.rar, sees a decoy PDF, and the archive silently drops an encrypted payload and a PowerShell loader into %ProgramData% and an LNK into the user’s Startup folder; the LNK runs the loader at the next logon, which is the persistence. The detection logic is a file-creation rule for any .lnk, .bat, .cmd, .ps1 or .exe written under \Microsoft\Windows\Start Menu\Programs\Startup\ (user or all-users) where the writing process is WinRAR.exe, Rar.exe, UnRAR.exe or another archiver, plus a companion rule for the same archiver writing a script or executable into %ProgramData% in the same second, and a logon-time rule for an LNK in Startup launching powershell.exe against a file in %ProgramData%.

Use EDR or Sysmon file-creation events (Event ID 11) with the creating process, and process creation with parent lineage for the logon stage. Sweep 180 days, because CVE-2025-8088 is not unique to Gorbag (ESET first saw RomCom exploit it as a zero-day) and the LNK survives until someone removes it; scope fleet-wide. Hash-blocking the RAR is the wrong primary control because each target gets a fresh archive; patching WinRAR and inventorying old versions (including copies bundled inside other software) closes the hole. The rule generalizes to every exploit of this bug and to older archiver traversal bugs. Treat a hit as a successful exploit: remove the LNK, collect the %ProgramData% payload and loader, and investigate the host for BeautyStealer activity.

Hunt Lead Level: 2 (Pro)

ATT&CK: Execution → T1203 (Exploitation for Client Execution); Persistence → T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder) (mapping per source article)

Sources: “Gorbag: Orcs on the border, harvesting intelligence in Ukraine”, ESET Research, Nov. 2026, https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/ (source article)

Excel Dropping an Executable Into ProgramData

In the 2025 chain the lure додаток податкова.xlsm needs macros enabled (or a policy that runs them automatically); a short VBA routine then reads a Base64 blob stored across a range of worksheet cells, decodes it, writes the BeautyStealer binary into %ProgramData% and runs it. Because the payload lives inside the cells rather than being downloaded, there is no network fetch to catch at this stage. The detection logic is a file-creation rule for EXCEL.EXE writing a PE file (by extension or by MZ header where the sensor supports it) under C:\ProgramData\, chained to a process-creation rule for that same file starting with EXCEL.EXE as parent or grandparent, and a document-scanning rule at the mail gateway for XLSM attachments containing VBA that calls Base64 decoding over a cell range.

Use EDR file and process telemetry and mail-gateway attachment analysis. Sweep 18 months, since this was the group’s main method throughout 2025. Scope to all Office users, prioritizing finance, legal and administrative staff who routinely receive fines and tax notices. Allowlist known business add-ins by signer and exact path rather than excluding ProgramData broadly. Relying on antivirus signatures for the dropped binary is the wrong choice given BeautyStealer’s frequent versions; the Office-to-PE parentage is the stable anchor, and it generalizes to most macro droppers. The strongest preventive step is blocking macros in files marked as coming from the internet. A confirmed hit means the stealer likely ran: escalate, then rotate the user’s browser sessions and credentials.

Hunt Lead Level: 2 (Pro)

ATT&CK: Execution → T1204.002 (User Execution: Malicious File); Defense Evasion → T1027.009 (Obfuscated Files or Information: Embedded Payloads) (mapping per source article)

Sources: “Gorbag: Orcs on the border, harvesting intelligence in Ukraine”, ESET Research, Nov. 2026, https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/ (source article)

Non-Browser Process Harvesting Browser and Key Stores, Then Uploading

BeautyStealer reads cookies, stored passwords, Local State and history from Chrome, Edge, Opera and Firefox profiles, OpenVPN configurations from user and system directories, and files with about 45 extensions from Desktop, Documents, Downloads, removable media and mapped drives, notably .ovpn, .kdbx, .rdp, .pfx, .jks and .zs2, plus an odd .bwetyutgvy extension ESET thinks was an exfiltration test. It compresses the haul, sends it through the Telegram Bot API sendDocument method (versions to 1.1) or a FastAPI server (1.2 onward, RC4-encrypted in 2.0), then deletes itself, with BAT scripts in earlier builds and a direct DeleteFile call in 2.0. The detection logic correlates per process within minutes: file reads of Cookies, Login Data or Local State in at least two different browsers’ profile paths by a process that is not that browser, reads of .ovpn, .kdbx or .zs2 files by the same process, an outbound HTTPS connection from it to api.telegram.org or to a rare external IP, and deletion of the process’s own image or a BAT file shortly after.

Use EDR file-access telemetry (or Windows object-access auditing on browser profile folders where EDR doesn’t record reads), process network events and DNS logs. Sweep 90 days and scope to all user endpoints, with priority on staff who hold VPN profiles or qualified signature keys. Baseline legitimate readers first, such as backup agents, password-manager importers and endpoint security, and allowlist them by signer and path. Blocking api.telegram.org outright may be acceptable on government networks but breaks legitimate use elsewhere, and it does nothing against the newer FastAPI exfiltration; the read-then-upload-then-self-delete sequence is the anchor, and it generalizes to most commodity and state-aligned stealers. Any confirmed sequence means data left the host: escalate, revoke VPN profiles and signing keys, and force sign-outs for the user’s web sessions.

Hunt Lead Level: 3 (Elite)

ATT&CK: Credential Access → T1555.003 (Credentials from Password Stores: Credentials from Web Browsers); Credential Access → T1539 (Steal Web Session Cookie); Exfiltration → T1567 (Exfiltration Over Web Service) (mapping per source article)

Sources: “Gorbag: Orcs on the border, harvesting intelligence in Ukraine”, ESET Research, Nov. 2026, https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/ (source article); “Russia-Aligned Gorbag Hackers Exploit WinRAR Flaw to Deploy Data-Stealing Malware”, The Hacker News, Nov. 3, 2026, https://thehackernews.com/2026/11/russia-aligned-gorbag-hackers-exploit.html (additional source, same campaign)

Hash Appendix

Gorbag lures and Prime ReverseShell

SHA-1s come from the source article; ESET did not publish MD5s or SHA-256s in the post, and OTX AlienVault and VirusTotal were not checked. No hashes were published for BeautyStealer builds, the PowerShell loader or the Startup LNK in the article; ESET’s GitHub IOC repository may hold more.

MD5s
(not available)  # spearphishing email -> lure message
(not available)  # Windows Telemetry -> Prime ReverseShell
(not available)  # додаток податкова.xlsm -> XLSM macro lure (2025)
(not available)  # Повідомлення 4726-49.rar -> CVE-2025-8088 archive (2026)

SHA1s
C17369B4B49113D07F080DF832E218156FB0940F  # spearphishing email -> lure message
A5E0A82BF6CC302A20D917235643B748F73FCC27  # Windows Telemetry -> Prime ReverseShell
E27E0D0A4B308F9B6B0469159931EB5E343E7FF8  # додаток податкова.xlsm -> XLSM macro lure (2025)
0589D2079FBEF814DC7BB95C4B3B555C8B933AF6  # Повідомлення 4726-49.rar -> CVE-2025-8088 archive (2026)

SHA256s
(not available)  # spearphishing email -> lure message
(not available)  # Windows Telemetry -> Prime ReverseShell
(not available)  # додаток податкова.xlsm -> XLSM macro lure (2025)
(not available)  # Повідомлення 4726-49.rar -> CVE-2025-8088 archive (2026)

References Appendix

• “Gorbag: Orcs on the border, harvesting intelligence in Ukraine”, ESET Research, WeLiveSecurity (Damien Schaeffer), Nov. 2026, https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/ (source article; chains, BeautyStealer capabilities, IoCs and ATT&CK table)
• “Russia-Aligned Gorbag Hackers Exploit WinRAR Flaw to Deploy Data-Stealing Malware”, The Hacker News, Nov. 3, 2026, https://thehackernews.com/2026/11/russia-aligned-gorbag-hackers-exploit.html (alias reconciliation with UAC-0226 and SHADOW-EARTH-066)
• MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/