MediumCVE-2025-8088 4 Hunt LeadsIOCsHands-On-KeyboardGorbagBeautyStealerGIFTEDCROOKPrime ReverseShellESET Research
Gorbag Turns a WinRAR Bug on Ukraine’s Police and Front-Line Councils
ESET says Russia-aligned Gorbag (UAC-0226, SHADOW-EARTH-066) has targeted Ukrainian law enforcement, justice, front-line councils and defense since February 2025, now exploiting WinRAR's CVE-2025-8088 to plant BeautyStealer, which takes browser logins, VPN profiles and signing keys.