Russia-Aligned Gorbag Group Exploits WinRAR Vulnerability for Data-Stealing Malware Attacks

Russia-aligned Gorbag hackers have exploited a WinRAR vulnerability to deploy data-stealing malware targeting Ukrainian organizations since February 2025. The attacks specifically focus on law enforcement, justice entities, and defense sectors.

A Russia-aligned threat actor known as Gorbag has been observed using simple information stealer malware in attacks targeting Ukrainian organizations.

"Active since at least February 2025, the group has focused exclusively on Ukrainian targets, with a clear preference for law enforcement and justice entities, local administrations near the front line, and the defense sector," ESET researcher

Read original article