FlagThis — Daily Cybersecurity Intelligence Briefing

The Russia-aligned espionage group Gorbag is targeting Ukrainian government institutions using malicious WinRAR archives that exploit a path traversal vulnerability to write arbitrary files outside the extraction directory. Attackers deploy malicious .LNK shortcuts that trigger a loader, which installs BeautyStealer to harvest browser credentials, cookies, history, and local documents before exfiltrating data to C2 infrastructure and self-deleting. This campaign enables persistent intelligence gathering against sensitive governmental communications and requires immediate WinRAR patching and archive-based threat detection.