Gorbag

Russia-Aligned Gorbag Hackers Exploit WinRAR Flaw to Deploy Data-Stealing Malware

According to ESET researchers, a Russia-aligned threat actor known as Gorbag has been conducting cyber espionage campaigns against Ukrainian entities since at least February 2025. The attacks leverage a vulnerability in WinRAR to deliver simple information stealer malware, with a focused preference for law enforcement, justice, local administration, and defense sector targets near the front lines.