Russia-Aligned Gorbag Targets Ukraine for Intelligence
Russia-Aligned Gorbag has a newly disclosed security flaw that should concern anyone running it.
Russia-Aligned Gorbag has a newly disclosed security flaw that anyone running it should know about.
This requires local or already-authenticated access to reach.
Damien Schaeffer of ESET detailed the group, which the firm named Gorbag, in research published on November 3, after presenting it at Virus Bulletin in October.
ESET found targets only in Ukraine, many of them near the Russian border.
In early 2026, the group switched to RAR archives exploiting CVE-2025-8088 , a WinRAR path traversal flaw ESET reported in August 2025 after seeing RomCom, another Russia-aligned group, exploit it as a zero-day.
ESET assessed that the group may be cooperating with others this way but has not observed any later stages.
Anyone running Russia-Aligned Gorbag is exposed, specifically wherever Russia-Aligned Gorbag is actually deployed rather than just licensed or installed somewhere unused.
The rest included defense entities and an organization publicly documented as a major transport hub for foreign military aid.
Read more on Russia-aligned threats to Ukraine: Russia-Aligned UAC-0099 Evolves MATCHBOIL Malware In 2025, Gorbag sent spearphishing emails themed around administrative fines and taxes, one of them from a compromised local government account.
What an attacker actually gains: the advisory describes a real security impact once the vulnerable path is reached.
ESET said the choices closely align with Russia's wartime intelligence priorities, pointing to possible interest in war-crimes prosecutions, damage from air strikes and incoming military supplies.
BeautyStealer deleted itself after sending its haul to Telegram or a custom server, and ESET said the toolset was built to collect data in a single pass rather than keep long-term access.
This is tracked as CVE-2025-8088 -- use that identifier when checking vendor guidance or scanner results.
One possible explanation, the firm said, is that Gorbag acts as an initial access broker, passing credentials to other threat actors.
A version of Prime ReverseShell, a PowerShell reverse shell used before BeautyStealer, carried a comment aimed at AI analysis: ESET tested it on two AI assistants, and neither was misled.
Confirm whether Russia-Aligned Gorbag is present anywhere in your asset and software inventory.
No exploitation has been reported yet, but that status can change, so keep watching vendor guidance while you remediate.
What happened
Russia-Aligned Gorbag has a newly disclosed security flaw that should concern anyone running it.
Access to this vulnerability requires local or already-authenticated credentials.
Damien Schaeffer of ESET detailed the group, named Gorbag, in research published on November 3, following a presentation at Virus Bulletin in October.
What changed
ESET identified that the group's targets are exclusively in Ukraine, with many located near the Russian border.
In early 2026, the group began utilizing RAR archives to exploit CVE-2025-8088, a WinRAR path traversal flaw that ESET reported in August 2025 after observing RomCom, another Russia-aligned group, exploit it as a zero-day.
ESET assessed that the group may be collaborating with others in this manner but has not observed any further developments.
Who is affected
Anyone running Russia-Aligned Gorbag is at risk, particularly in locations where it is actively deployed rather than merely licensed or installed in inactive environments.
The affected entities include defense organizations and a publicly documented major transport hub for foreign military aid.
In 2025, Gorbag targeted individuals with spearphishing emails themed around administrative fines and taxes, including one from a compromised local government account.
Why it matters
The advisory outlines the tangible security risks once the vulnerable path is accessed.
ESET noted that the group's actions align closely with Russia's wartime intelligence priorities, suggesting interest in war-crimes prosecutions, damage assessments from airstrikes, and monitoring incoming military supplies.
BeautyStealer removed itself after transmitting its collected data to Telegram or a custom server, and ESET indicated that the toolset was designed for single-pass data collection rather than maintaining long-term access.
Technical details
This vulnerability is tracked as CVE-2025-8088; use this identifier to check vendor guidance or scanner results.
One possible explanation provided by the firm is that Gorbag functions as an initial access broker, transferring credentials to other threat actors.
A version of Prime ReverseShell, a PowerShell reverse shell previously used before BeautyStealer, contained a comment intended for AI analysis: ESET tested it on two AI assistants, and neither was deceived.
What security teams should do
Verify whether Russia-Aligned Gorbag is present in your asset and software inventory.
While no exploitation has been reported yet, that status can change, so continue monitoring vendor guidance as you remediate.