Russia-Aligned Gorbag Hackers Exploit WinRAR Flaw to Deploy Data-Stealing Malware

ESET researchers have uncovered a cyber espionage campaign attributed to a Russia-aligned threat actor tracked as Gorbag. Active since at least February 2025, the group has focused exclusively on Ukrainian targets, with a clear preference for law enforcement and justice entities, local administrations near the front line, and the defense sector.

The attacks involve the exploitation of a flaw in WinRAR to deploy information stealer malware. The malware is described as simple in nature, aimed at data exfiltration rather than destructive payloads. ESET notes that the threat actor's operations have been ongoing, with recent activity reported in November 2026.

The use of a WinRAR vulnerability suggests the actor is leveraging a known vector to gain initial access or execute code, though the exact CVE number and detailed exploit mechanics were not specified in the source reporting. The focus on Ukrainian organizations aligns with the broader geopolitical context of the region.

ESET and CERT/CC have likely issued advisories urging users to update WinRAR to a patched version to mitigate the risk, though the source does not provide a specific CVE identifier.