# SZB-9dcda68ffb: ESET reports Gorbag hackers exploit WinRAR flaw to deploy info-stealing malware

ESET researchers report that the Russia-aligned threat actor Gorbag is exploiting a WinRAR flaw to deliver simple information-stealing malware.

- Type: Early warning
- Kind: Vulnerability
- Vendor: RARLAB
- Product: WinRAR
- Status: Reported, not confirmed
- Sources: 1 distinct
- First seen: 2026-11-03 12:48 UTC

> No statement or filing from RARLAB has reached cve.now yet. Every claim below is quoted from, and linked to, the source that made it.

Written by a model from the sources below. Verify against them.

## Summary

ESET researchers report that the Russia-aligned threat actor Gorbag is exploiting a WinRAR flaw to deliver simple information-stealing malware. The attacks target Ukrainian organizations, particularly law enforcement, justice bodies, front-line local administrations, and defense firms.

## What to do

- Update WinRAR to the latest version from the vendor
- Be cautious opening archives from unknown or unexpected senders
- Review systems that run WinRAR for signs of information-stealing malware
- Rotate credentials stored on systems where suspicious archives were opened

## Timeline

- 2026-11-03 11:00 UTC: Made public by The Hacker News
- 2026-11-03 12:48 UTC: First seen by cve.now

## Evidence (1 source)

- 2026-11-03 · Press · [The Hacker News](https://thehackernews.com/2026/11/russia-aligned-gorbag-hackers-exploit.html): “A Russia-aligned threat actor known as Gorbag has been observed using simple information stealer malware in attacks targeting Ukrainian organizations.”

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-9dcda68ffb&body=https%3A%2F%2Fcve.now%2FSZB-9dcda68ffb%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about SZB-9dcda68ffb

### Has RARLAB confirmed it?

The Hacker News reports it. No statement from RARLAB has reached cve.now yet.

Source: https://thehackernews.com/2026/11/russia-aligned-gorbag-hackers-exploit.html

### What should RARLAB users do?

Update WinRAR to the latest version from the vendor. Be cautious opening archives from unknown or unexpected senders. Review systems that run WinRAR for signs of information-stealing malware. Rotate credentials stored on systems where suspicious archives were opened.

## Related

- Browse: [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/SZB-9dcda68ffb
Site guide for agents: https://cve.now/llms.txt