ESET reports Gorbag hackers exploit WinRAR flaw to deploy info-stealing malware
ESET researchers report that the Russia-aligned threat actor Gorbag is exploiting a WinRAR flaw to deliver simple information-stealing malware.
Written by a model from the sources below. Verify against them.
- Kind
- Vulnerability
- Vendor
- RARLAB
- Product
- WinRAR
- Status
- Reported, not confirmed
- First seen
Summary
ESET researchers report that the Russia-aligned threat actor Gorbag is exploiting a WinRAR flaw to deliver simple information-stealing malware. The attacks target Ukrainian organizations, particularly law enforcement, justice bodies, front-line local administrations, and defense firms.
What to do
Update WinRAR to the latest version from the vendor
Be cautious opening archives from unknown or unexpected senders
Review systems that run WinRAR for signs of information-stealing malware
Rotate credentials stored on systems where suspicious archives were opened
Timeline
- Made public by The Hacker News
- First seen by cve.now
Evidence 1
- PressThe Hacker News
“A Russia-aligned threat actor known as Gorbag has been observed using simple information stealer malware in attacks targeting Ukrainian organizations.”
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about SZB-9dcda68ffb
Has RARLAB confirmed it?
The Hacker News reports it. No statement from RARLAB has reached cve.now yet.Source: The Hacker News
What should RARLAB users do?
Update WinRAR to the latest version from the vendor. Be cautious opening archives from unknown or unexpected senders. Review systems that run WinRAR for signs of information-stealing malware. Rotate credentials stored on systems where suspicious archives were opened.