Gorbag hackers exploit WinRAR flaw targeting Ukraine

Russia-aligned threat actor Gorbag is using WinRAR vulnerabilities to deploy information-stealing malware against Ukrainian organizations. Active since at least February 2025, the group targets law enforcement, justice entities, local administrations near the front line, and defense sector organizations. Defenders in targeted sectors should prioritize patching WinRAR and monitoring for suspicious data exfiltration activity.