Gorbag Exploits WinRAR Path Traversal to Deploy BeautyStealer Against Ukrainian Government Entities

The Russia-aligned espionage group Gorbag is targeting Ukrainian government institutions using malicious WinRAR archives that exploit a path traversal vulnerability to write arbitrary files outside the extraction directory. Attackers deploy malicious .LNK shortcuts that trigger a loader, which installs BeautyStealer to harvest browser credentials, cookies, history, and local documents before exfiltrating data to C2 infrastructure and self-deleting. This campaign enables persistent intelligence gathering against sensitive governmental communications and requires immediate WinRAR patching and archive-based threat detection.

• Incident Overview: Gorbag Campaign Against Ukraine

  • Targets Ukrainian government entities and administrative institutions.
  • Attributed to Russia-aligned threat actor Gorbag.
  • Severity rated High; activity linked to CERT-UA tracked intrusions.
  • CERT-UA advisories likely associated with observed intrusions.
  • Objective is espionage via sensitive governmental data exfiltration.

• Attack Vector: WinRAR Path Traversal Exploitation

  • Initial access via malicious .rar and .zip archive files.
  • Path traversal flaw allows arbitrary file writes outside extraction folder.
  • Malicious .LNK shortcut placed externally executes upon user interaction.
  • Exploit leverages archive extraction logic to drop payloads in startup or user paths.
  • Technique bypasses expected archive containment to achieve code execution.

• Payload Mechanics: BeautyStealer Data Theft

  • .LNK shortcut triggers loader that deploys BeautyStealer module.
  • Harvests browser credentials, cookies, and browsing history.
  • Collects local documents and sensitive files from victim endpoints.
  • Self-deletion mechanism hinders post-incident forensic analysis.
  • Exfiltrates harvested data to attacker-controlled C2 then self-deletes.

• Threat Attribution and Scale

  • Gorbag assessed as Russia-aligned cyberespionage actor.
  • Campaign focuses on Ukrainian defense, administration, and transport sectors.
  • Targets include defense sector and transportation hubs per ESET reporting.
  • Persistent intrusion pattern indicates long-term intelligence collection.
  • Exact start date pending confirmation; activity under active tracking.

• Indicators of Compromise and Mitigation

  • IOCs include archive names, shortcut names, file hashes, C2 domains/IPs.
  • File hashes and C2 indicators available from Xcitium and ESET feeds.
  • Apply WinRAR vendor patches to remediate path traversal vulnerability.
  • Block identified C2 infrastructure and monitor .LNK execution from archives.
  • Enforce EDR rules detecting archive-driven shortcut and loader execution.

• Strategic Conclusion

  • Archive-based social engineering remains a high-fidelity initial access method.
  • Campaign reflects sustained Russia-aligned espionage against Ukrainian state targets.
  • Continuous monitoring of archive-based initial access is recommended for critical infrastructure.
  • Immediate patching, archive scanning, and user awareness are critical controls.