Russia-Aligned Gorbag Hackers Exploit WinRAR Flaw to Deploy Data-Stealing Malware

A Russia-aligned threat actor known as Gorbag has been using simple information stealer malware to target Ukrainian organizations. The group has been active since at least February 2025 and has focused on specific sectors, including law enforcement, justice entities, local administrations near the front line, and the defense sector. Gorbag hackers are exploiting a WinRAR flaw to deploy the data-stealing malware. The attacks are concentrated on Ukrainian targets, indicating a targeted campaign by the group. The threat actor's activities suggest a deliberate effort to gather sensitive information from these organizations. ESET researchers have been tracking the group's activities.