Russia-Aligned Gorbag Group Uses WinRAR Flaw and Phishing Emails to Steal Browser Data and VPN Settings

A Russia-aligned threat actor known as Gorbag has been using simple information stealer malware against Ukrainian organisations, according to ESET researcher Damien Schaeffer. The group has been active since at least February 2025 and has focused only on Ukrainian targets, especially law enforcement and justice bodies, local administrations near the front line, and the defence sector. Its activity overlaps with clusters tracked by CERT-UA and Trend Micro.

Gorbag's attacks use spear-phishing emails with malicious attachments and official-looking lures, such as administrative fines or taxes. In one case, a macro-enabled Excel spreadsheet runs a script that decodes and launches a stealer called BeautyStealer. Trend Micro also linked the group to attacks that abused a now-patched WinRAR vulnerability (CVE-2025-8088) to run another stealer, GIFTEDCROOK. These tools take cookies, browsing history and saved logins from Chrome, Edge, Firefox and Opera, along with VPN and remote desktop configurations, KeePass databases, and files such as Office documents, archives and emails.

Because the malware collects VPN settings and documents, ESET says Gorbag may act as an initial access broker, passing stolen data to other actors who carry out further attacks. ESET notes that if this is true, Gorbag may be only the first stage of a longer intrusion chain whose later stages have not yet been observed.