ESET Links Gorbag to WinRAR Exploit Campaign Against Ukrainian Entities

Key points

• ESET attributes the February 2025 campaign to Gorbag, an actor aligned with Russian interests.
• The group abused a vulnerability in WinRAR to deliver malware that harvests information.
• Targets included Ukrainian police, judicial bodies, municipal offices, and defense-sector organizations.
• The operation combined data theft with malicious code installation on victim systems.

In February 2025, ESET reported that a threat group called Gorbag, which the security firm describes as aligned with Russian interests, carried out attacks against multiple entities in Ukraine. The campaign used a weakness in WinRAR, the widely used archive utility, as part of its intrusion path. Once inside, the attackers installed malware designed to harvest information from compromised systems.

The victims were not random. They included Ukrainian law enforcement agencies, judicial institutions, local government administrations, and organizations connected to the defense sector. That targeting pattern suggests the operation was intended to collect sensitive data from bodies involved in public safety, legal proceedings, municipal administration, and national defense.

The combination of a familiar file-compression tool and data-stealing malware is significant because WinRAR is common across government and enterprise environments. An archive-based delivery method can bypass user suspicion and may evade controls that focus on executables rather than compressed files. For K-12 and government networks, the incident reinforces the need to treat archive handling as part of the attack surface, not as a benign utility function.

ESET's attribution adds a geopolitical dimension: a Russia-aligned actor is accused of using the campaign to steal information and deploy malicious code against Ukrainian institutions. While no CVE was provided in the facts, the reported exploitation of a WinRAR flaw shows how unpatched or poorly managed archive software can become an entry point. Organizations should watch for similar archive-borne delivery attempts, unusual outbound data flows, and signs of data-harvesting malware on endpoints.

Because the campaign affected justice, law enforcement, local administration, and defense entities, the potential impact extends beyond immediate system compromise. Stolen information could expose investigative details, internal communications, or operational planning. Administrators should prioritize patching archive tools, restricting untrusted archive execution, and monitoring for anomalous file activity tied to compressed content.

What to do now

1. Patch WinRAR and any other archive utilities to the latest vendor-supported version, and verify versions across endpoints and servers.
2. Block or quarantine archive files from untrusted sources at email and web gateways, especially when they contain executables or scripts.
3. Restrict users from launching executables directly from compressed archives, and enforce application control where feasible.
4. Hunt for signs of data-harvesting malware on endpoints, including unusual process creation from archive tools and anomalous outbound connections.
5. Review logs for archive-based delivery attempts and alert on suspicious files opened from WinRAR or similar utilities.
6. Brief users in government and education environments about archive-borne threats and require verification of unexpected attachments.
7. Segment sensitive systems used by justice, law enforcement, and defense-related functions, and limit access to only necessary personnel.

Original source

The Hacker News