Malicious archives are helping a Russia-aligned espionage group steal browser data and documents from Ukrainian institutions. The group, Gorbag, uses a WinRAR flaw to place a shortcut outside the extraction folder. That shortcut later launches a loader for BeautyStealer, a data collector designed to send its findings away and then remove itself.
Activity tracked since February 2025 targets government, justice, law enforcement and defense organizations, including local administrations near the front line. Technical reporting published on November 3, 2026 describes an operation built around brief collection runs. Its targets give ordinary browser profiles and working documents potential wartime intelligence value.
Government-Themed Mail Delivers The First Stage
Throughout 2025, Gorbag relied on Excel attachments disguised as routine official correspondence. Administrative fines and taxes supplied familiar reasons to open a spreadsheet. In at least one documented case, the message came from a compromised Ukrainian local-government mailbox.
The spreadsheet route depended on macros running, either after the recipient enabled them or because existing settings permitted execution. When that happened, the Workbook_Open procedure decoded a payload from Base64 strings stored in worksheet cells. It then wrote BeautyStealer into a directory under %ProgramData% and launched it.
This placed the executable inside the document’s data before the victim opened it. However, the spreadsheet still needed macro execution to turn those stored strings into a running program.
WinRAR Extraction Redirects Files Into Startup
In early 2026, the group adopted malicious RAR attachments exploiting CVE-2025-8088, a path traversal flaw in Windows versions of WinRAR. Here, the decisive action is processing the archive with vulnerable extraction software.
The crafted archive abuses alternate data streams, an NTFS feature that allows additional named data streams alongside a file’s main contents. During extraction, the flaw lets specially constructed stream paths escape the destination the user selected. As a result, the archive can write supporting files elsewhere on the machine while presenting a decoy PDF.
One analyzed archive plants three components. A .lnk shortcut goes into the user’s Windows Startup folder, while an encrypted payload and a PowerShell loader go under %ProgramData%. The user sees a document; the extraction operation also prepares a later execution path.
WinRAR 7.13, released in July 2025, fixed this vulnerability. The 2026 campaign therefore exploits an already documented flaw on vulnerable installations.
The Shortcut Connects Extraction To Code Execution
Inside Windows, the Startup folder gives the planted shortcut its execution trigger. Windows starts applications linked there when the relevant user signs in, so the archive does not need the victim to find and open the loader separately.
The recovered shortcut invokes a command shell and then PowerShell with hidden-window and execution-policy bypass options. PowerShell reads the loader from disk and evaluates its contents. That loader decrypts the separate payload and executes it, completing the handoff to BeautyStealer.
Because the shortcut, loader and encrypted payload have separate roles, the decoy document alone cannot describe the execution chain. The archive supplies the placement mechanism, Windows supplies the startup event, and the script turns encrypted data into running code.
Browser Stores And Working Folders Feed Collection
Once active, BeautyStealer gathers browser material from Chrome, Edge, Opera and Firefox. Its targets include cookies, saved-login stores and browser state. The published analysis identifies browser files such as Login Data, Local State, cookies.sqlite and logins.json.
For working documents, the collector locates familiar Windows folders through SHGetKnownFolderPath, which resolves a known-folder identifier into its actual path. This lets the code find locations such as Desktop, Documents and Downloads without relying solely on one hardcoded user directory.
File collection follows extension lists embedded in the malware. Those lists cover office documents, archives, email files and other selected formats. Later reporting also identifies removable media and mapped network drives among its collection locations.
However, the supported scope is files and data accessible to the compromised process. A mapped drive can extend the reach of that account; it does not establish unrestricted access to every server in the organization.
Configuration Files And Keys Broaden The Exposure
The target list reaches beyond documents. BeautyStealer seeks VPN configuration files in user and system locations, password-manager databases, Java keystores and certificate-related files. Such material can reveal connection details or contain additional secrets, depending on how the organization stores it.
Particularly relevant to Ukrainian institutions are .zs2 electronic-signature key files. Collecting a file that holds a signing key creates a different exposure from copying a completed document. However, the investigation does not document a successful forged signature or establish that every collected key was usable.
Likewise, copying browser stores describes the collection stage. The report does not demonstrate successful decryption or session reuse for every browser version and affected account. Those outcomes depend on the protection and state of the material collected.
Exfiltration And Cleanup Changed Across Versions
Early BeautyStealer versions send collected data through a messaging service’s sendDocument API, which supports file delivery to a selected chat. Before uploading, the malware stages collected material in files and builds a compressed archive.
From version 1.2, the documented route shifts to an attacker-controlled server implementing FastAPI, using HTTPS POST requests. This changes the receiving infrastructure while preserving the basic collection, packaging and upload sequence.
Version 2.0 also introduces RC4 encryption and revises cleanup. Earlier samples drop batch scripts that delete the collector and then themselves. The newer implementation uses Windows APIs, including DeleteFile for dropped files and CreateProcessW to start a process involved in self-deletion.
Consequently, startup-based execution and a short-lived collector coexist in the same operation. The shortcut provides a launch mechanism, while the collector’s cleanup follows its upload. Self-deletion reduces local artifacts after theft; it does not retract information already sent away.
Target Selection Points To Wartime Intelligence
About a quarter of the reported targets belong to justice or law enforcement, while another quarter are local-government entities. The remaining set includes defense organizations and a transportation hub associated with foreign military aid.
These choices support the assessment of Russian-aligned intelligence collection. Justice records could expose investigations, while municipal documents could reveal infrastructure damage or local defense activity. However, these proposed purposes remain assessments. Public evidence does not identify a specific government handler or prove that another group received the stolen credentials.
We examined a different approach to Windows espionage persistence in our BlackX bootkit analysis. That operation extended an existing intrusion below Windows. Here, the documented emphasis is rapid file and credential collection, with any later use of the stolen access still unresolved.
Conclusion: Archive Extraction Became A Startup Command
Gorbag turned a routine document workflow into a delayed execution path. A message encouraged the recipient to handle an attachment, while a vulnerable extractor wrote files beyond the chosen destination. The planted shortcut then used Windows sign-in to launch PowerShell and the collector. Each stage gave the next one something it needed, from file placement to code execution and data access.
The response therefore needs evidence from both delivery and execution. Updating the extractor closes the documented vulnerability, while investigating the shortcut, loader and account activity establishes what happened before that update. Because the collector attempts to delete itself after uploading data, its absence can leave an important part of the incident unresolved.
Why This Threat Matters
- Official correspondence can carry hostile instructions. Compromised mailboxes give administrative lures a credible delivery channel, so familiar senders still require scrutiny when the requested action is unusual.
- Extraction can prepare later execution. A Startup shortcut connects an earlier attachment interaction to a later sign-in, separating delivery from the moment the payload runs.
- Working folders hold operational information. Documents and accessible mapped drives can expose institutional records through the compromised user’s existing permissions.
- Secrets require their own exposure review. Browser stores, VPN files and signing-key material create different recovery tasks, even when their subsequent use remains unconfirmed.
- Cleanup can remove useful evidence. A short collection run can finish before discovery, making preserved process, file and network records valuable to the investigation.
Where Defensive Control Must Operate
Xcitium Advanced EDR, powered by Xcitium’s patented Zero-Dwell platform, provides behavioral monitoring, forensic telemetry and response on supported, managed Windows endpoints. The relevant investigation follows the extractor, new startup entry, PowerShell activity and subsequent payload. Execution Governance restricts unknown execution under the endpoint’s configured policy, adding an enforcement point around the untrusted loader and executable stages.
Xcitium Cyber Awareness Education develops recognition of social engineering and unsafe attachment workflows. Here, training should emphasize unexpected administrative requests and pressure to enable active document content. Phishing Simulation tests responses to realistic, sector-relevant messages and supports targeted follow-up training. Administrative correspondence provides an appropriate exercise theme because that deception appears in the documented delivery chain.
Technical policy should also address both entry routes. Restrict unnecessary document macros and verify the installed extraction software across the affected fleet. Then review startup entries alongside the files they launch, since removing only one component can leave the investigation incomplete.
Recover The Endpoint And Review Exposed Access
Isolate suspected endpoints and preserve volatile evidence before disruptive cleanup or restarts where feasible. Establish which accounts, browser stores and shared locations the affected process could access. From trusted systems, revoke affected sessions and replace exposed credentials; coordinate any signing-key response with the responsible service owner. Finally, verify the software version and startup state before returning the device to use, and retain the evidence supporting that decision.
