Russia-Aligned Gorbag APT Exploits WinRAR CVE-2025-8088 to Deploy BeautyStealer Infostealer
The findings, detailed in ESET’s “Gorbag: Orcs at the border” research presented at Virus Bulletin 2026, connect previously reported GIFTEDCROOK tooling with a broader espionage operation. In early 2026, the operators shifted to weaponized RAR attachments exploiting CVE-2025-8088. The path traversal flaw…