A path traversal flaw lets an archive write files outside the folder the user chose to extract into. CVE-2025-8088 is that kind of flaw in the Windows version of WinRAR, and it works through NTFS alternate data streams, a hidden second layer of data attached to a file. ESET Research reported on 3 November 2026 that a Russia-aligned actor it calls Gorbag turned this flaw into a delivery route for its BeautyStealer malware against Ukrainian organisations.
This explainer covers the flaw first, then shows how Gorbag used it, what BeautyStealer takes and what defenders can check. The sources are ESET’s research on Gorbag, ESET’s earlier write-up of the flaw and the NVD record.
- Reporter.
- ESET Research (Damien Schaeffer), 3 November 2026.
- Actor.
- Gorbag, Russia-aligned, active since at least February 2025.
- Targets.
- Ukrainian law enforcement and justice, front line local administrations, defense sector.
- Flaw.
- CVE-2025-8088, WinRAR path traversal, fixed in WinRAR 7.13.
- Malware.
- BeautyStealer, a C++ browser data and file stealer.
- Earlier lure.
- Macro enabled .xlsm spreadsheets in 2025.
How Does CVE-2025-8088 Let an Archive Escape Its Folder?
ESET describes the flaw as a path traversal bug that uses alternate data streams. An attacker builds a RAR archive that looks like it holds one harmless file but also contains hidden streams. When the victim opens it, WinRAR extracts those streams to attacker chosen locations, using paths with increasing numbers of parent directory elements to climb out of the extraction folder.
ESET also saw decoy streams with invalid paths, which trigger visible WinRAR error warnings. ESET’s 2025 write-up suspects the decoys were added so the victim does not notice the suspicious DLL and LNK paths, which appear only when scrolling down in the WinRAR window. The effect is that opening a document inside an archive can place a file in a folder that runs code later, such as the Windows Startup folder.
The NVD record, published on 8 August 2025, describes a path traversal flaw in the Windows version of WinRAR that allows arbitrary code execution through crafted archives. It lists CVSS 3.1 8.8 High from NVD and CVSS 4.0 8.4 High from the CNA, ESET, with weakness CWE-35. NVD limits the affected range to WinRAR before 7.13, and CISA added the CVE to its Known Exploited Vulnerabilities catalogue on 12 August 2025.
ESET told the WinRAR developer on 24 July 2025 and WinRAR 7.13 was released on 30 July 2025. ESET first saw the flaw exploited as a zero-day by RomCom, another Russia-aligned group. Our CVE-2025-8088 page and the RomCom profile cover that earlier use.
How Did Gorbag Use It Against Ukrainian Targets?
ESET names Gorbag as an actor that is Russia-aligned and previously underreported, active since at least February 2025, and focused only on Ukraine. Targeting is spread across law enforcement and justice bodies, which ESET puts at about a quarter of the victims, and local administrations near the front line, also about a quarter. The remainder are defense organisations and logistics, including a transportation hub for foreign military aid.
ESET offers two readings of the local administration targets: battle damage assessment and monitoring of local defense efforts. It says the two are not mutually exclusive. It gives no victim counts.
In 2025 the group sent spearphishing emails with macro enabled .xlsm spreadsheets themed on administrative fines or taxes, in one case from a compromised Ukrainian local government mailbox. In early 2026 it switched to RAR archives that exploit CVE-2025-8088. Our spearphishing glossary entry explains why a mailbox from a trusted body helps the lure.
- Email with RAR archiveMailboxopens archive
- Archive opened in WinRARWindows hosthidden streams extracted
- Decoy PDF shownWindows hostuser sees a normal file
- LNK in Startup folder, loader in ProgramDataWindows hostnext logon
- BeautyStealer runsWindows hostcollects data
- Archive sent outAttacker side
On a vulnerable system the archive shows a decoy PDF, drops an LNK file into the Startup folder and places an encrypted payload and a PowerShell loader in %ProgramData%. The shortcut starts the loader at later startups. ESET lists Startup folder persistence (T1547.001) and spearphishing attachment (T1566.001) among the techniques.
What Does BeautyStealer Collect and How Does It Leave?
BeautyStealer is a C++ stealer that ESET tracked from version 0.9 to 2.0. It collects cookies, saved passwords and local state from Chrome, Edge, Opera and Firefox, plus browser history and OpenVPN configurations. It also takes files from Desktop, Documents, Downloads, removable media and mapped network drives.
| Version | What ESET says changed |
|---|---|
| 0.9 | Browser credentials only |
| 1.1 | Added file stealing |
| 1.2 | XOR string encryption and a custom command server |
| 2.0 | New naming scheme and compromise chain, RC4 encryption, self deletion through direct Windows API calls |
The file list is telling. ESET says the stealer looks for .ovpn, .kdbx, .jks, .zs2, .rdp and .pfx files, which cover VPN profiles, KeePass databases, Java key stores, remote desktop files and certificates. The .zs2 extension holds a secret electronic signature key issued by a Ukrainian accredited key certification centre.
Early versions sent the compressed archive through the Telegram sendDocument API to an attacker controlled chat. From version 1.2 it used a custom server built on FastAPI, and version 2.0 added RC4 encryption. The malware deletes itself afterwards, so a clean disk can still follow a successful theft.
Why Does ESET Think Gorbag May Be an Access Broker?
ESET says Gorbag’s operations look like one time, rapid information harvesting, not long term access. It suggests the group may act as an initial access broker that shares stolen credentials with other actors, and presents this as one possible explanation. Attribution to Russia rests on targeting that closely matches Russia’s wartime intelligence priorities.
ESET does not claim a direct link to RomCom, which only appears because it exploited the same flaw. It notes that elements of Gorbag’s tooling, most notably the GIFTEDCROOK infostealer, appeared in earlier public reporting, where CERT-UA attributes GIFTEDCROOK to UAC-0226. Earlier activity used a PowerShell reverse shell called Prime ReverseShell, and one variant carries a comment telling AI reviewers there is no need to analyse the file. ESET tested two AI assistants and says neither was misled.
What Can Defenders Check Today?
ESET gives these detection names: PowerShell/Agent.EJI and LNK/Runner.FB for the malicious RAR archive, VBA/TrojanDropper.Agent.DAT for the macro lure, Win64/PSW.Agent.MA for the spearphishing sample and PowerShell/ReverseShell.OB for Prime ReverseShell. It publishes hashes and network indicators in its public indicator repository.
- Update WinRAR to 7.13 or later on every Windows machine, and update software that bundles UnRAR.dll, as ESET advised in 2025.
- Hunt for LNK files in Startup folders paired with PowerShell loaders and encrypted blobs in %ProgramData%.
- Watch for macro enabled .xlsm files that decode base64 from cells and write to %ProgramData%.
- Alert on mass file reads of .ovpn, .kdbx, .pfx and .rdp files followed by archive creation and traffic to Telegram or an unfamiliar web server.
The first step restates ESET’s 2025 advice, and the hunt list follows ESET’s description of the chain. Moving VPN profiles, KeePass databases and certificates away from user folders and stricter mail controls for offices that work with Ukrainian institutions are our recommendations.
What Changes For Defenders?
An archive is no longer a passive container on an unpatched machine, because it can place a persistence file before the user clicks anything inside it. Patching the archiver belongs on the same list as the browser and the mail client. A stealer that deletes itself means detection must rely on the chain, not on a file left behind.
What would change our view: ESET or CERT-UA attributing Gorbag to a named cluster, or a statement from the affected bodies. We will update this explainer if either is published.