Russia-Aligned Gorbag Hackers Exploit WinRAR Flaw to Deploy Data-Stealing Malware

A Russia-aligned threat actor known as Gorbag has been conducting cyberattacks against Ukrainian organizations since at least February 2025. The group primarily targets law enforcement and justice entities, local administrations near the front line, and the defense sector in Ukraine. Gorbag exploits a vulnerability in WinRAR to deploy information-stealing malware. The campaign is focused exclusively on Ukrainian targets, suggesting a geopolitical motivation tied to the ongoing conflict. ESET researchers have been tracking this group and its activities. The malware used is described as a simple but effective information stealer. The exploitation of WinRAR flaws is a known technique used by various threat actors, particularly those aligned with Russian interests.