Security researchers have reported that the Russia-aligned threat actor known as Gorbag is using a WinRAR vulnerability to deploy information-stealing malware in attacks against Ukrainian organisations. The campaign is reported to be focused on entities in Ukraine, particularly in public-sector and defence-related environments, but it also highlights a broader business risk for European companies that still rely on common desktop tools and email-based document workflows.

What happened

According to reporting cited in the source, ESET observed Gorbag using a flaw in WinRAR as part of a malware delivery chain. The group has reportedly been active since at least February 2025 and has focused on Ukrainian targets, with an emphasis on law enforcement and justice bodies, local administrations near the front line, and the defence sector.

The malware used in the campaign is described as an information stealer. In practical terms, this type of malware is designed to collect data from infected systems, which can include stored credentials, browser data, files, or other information that may help attackers gain deeper access or support later espionage activity.

Based on the source material, the observed targeting is specific rather than broad consumer cybercrime. However, the technical method matters beyond the immediate victims because WinRAR remains widely used in business environments for handling compressed files received by email, shared through portals, or exchanged with external partners.

Why it matters for European businesses

Even when a campaign is concentrated on Ukrainian institutions, European businesses should pay attention for three reasons.

• Common software can become an entry point. Archive utilities such as WinRAR are often treated as routine workplace tools. If they are not updated quickly, attackers can use them as a low-friction route into business devices.
• Information stealers are a business risk, not only a consumer problem. Stolen passwords, browser sessions, email data and internal documents can lead to account compromise, supplier impersonation, fraud, or broader network intrusion.
• Regional conflict-driven campaigns can create spillover risk. Threat activity linked to the war in Ukraine may be targeted, but European companies working with public-sector bodies, logistics providers, manufacturers, NGOs, or cross-border partners can still face indirect exposure through phishing, shared files, compromised accounts, or reused techniques.

For SMEs in particular, the lesson is straightforward: a vulnerability in an everyday application can have outsized consequences if patching, endpoint controls and user awareness are weak.

Who may be affected

The reported campaign is aimed at Ukrainian organisations, especially those linked to government, justice, local administration and defence. For the wider European market, the most relevant organisations are those that depend on file exchange and external communications as part of daily operations.

• Businesses with employees who regularly open compressed attachments or downloaded archives
• Companies operating in or with Ukraine, including service providers and cross-border partners
• Organisations in regulated or sensitive sectors where credential theft could expose confidential data
• IT teams managing mixed desktop environments where software updates for utilities may be overlooked
• SMEs without mature endpoint detection, application control, or central patch management

Digital agencies, e-commerce businesses, and distributed teams should also note the operational risk. Browser-stored credentials, CMS logins, ad platform sessions and cloud administration accounts are all valuable targets for infostealer malware.

What companies should consider

• Check WinRAR versions and apply available security updates. If the organisation still uses WinRAR, confirm that all endpoints are running supported and fully patched versions.
• Review archive-file handling policies. Treat compressed files from email or third parties as potentially risky, especially when they come from unexpected senders or urgent requests.
• Strengthen endpoint detection. Ensure security tools can detect suspicious child processes, unusual archive behaviour, credential theft activity and malware persistence.
• Reduce reliance on stored credentials. Encourage password managers, limit browser-stored passwords where practical, and enforce multi-factor authentication on business-critical services.
• Prioritise phishing-resistant processes. Train staff to verify unexpected attachments and requests, particularly in finance, operations, procurement and executive support roles.
• Segment access and review privileged accounts. If an infostealer compromises one endpoint, segmentation and least-privilege controls can reduce the chance of wider compromise.
• Monitor for signs of account abuse. Watch for unusual logins, session hijacking indicators, mailbox rule changes, and suspicious access to cloud platforms.

The current reporting does not indicate that this activity is a broad campaign against all European businesses. Still, the combination of a known software flaw and credential-focused malware is highly relevant from an operational security perspective. For many organisations, the most important takeaway is not the geopolitics of the threat actor but the practical need to patch common software quickly and assume that stolen endpoint data can lead to wider business compromise.