# Russia‑Aligned ‘Gorbag’ Hackers Use Old WinRAR Bug to Steal Data from Ukrainian State Targets

*Tuesday, November 3, 2026 at 12:19 PM UTC — Hamer Intelligence Services Desk*

**Published**: 2026-11-03T12:19:36.376Z (2h ago)
**Category**: cyber | **Region**: Eastern Europe
**Importance**: 7/10
**Sources**: OSINT
**Permalink**: https://hamerintel.com/data/articles/22366.md
**Source**: https://hamerintel.com/summaries

---

**Deck**: Cybersecurity researchers say a Russia‑aligned group known as Gorbag is exploiting a previously patched WinRAR vulnerability to install GIFTEDCROOK malware on Ukrainian government and defense networks, harvesting browser data, credentials, VPN configurations and sensitive documents.

A Russia‑aligned hacking group is turning a long‑patched software flaw into a live tool against Ukrainian state institutions.

Researchers cited by The Hacker News say a cluster known as Gorbag is exploiting a previously disclosed WinRAR vulnerability to deliver custom malware to Ukrainian government and defense organizations. WinRAR is a widely used file‑archiving program, and the attackers are using its past weakness as an entry point.

The malware deployed in these attacks is called GIFTEDCROOK. Once installed, it acts as an information stealer. It collects browser data and stored credentials, copies VPN configuration files and searches for sensitive documents on compromised systems. The stolen material is then exfiltrated to servers under the group’s control.

The campaign shows how vulnerabilities can continue to be exploited even after vendors issue fixes. Many organizations take time to update or may leave older versions running on parts of their networks. Gorbag is sending booby‑trapped archive files that trigger code execution through the WinRAR flaw when opened, installing GIFTEDCROOK.

For Ukraine’s government and defense entities, the stakes are clear. Compromised VPN settings can reveal secure network structures, while captured browser credentials can grant access to email, cloud services and internal tools. Sensitive files taken from workstations and shared drives can expose operational details.

This activity fits into the wider pattern of Russian‑aligned cyber operations that accompany the war in Ukraine. As missiles and drones hit physical targets, hacking groups probe ministries, military bodies and infrastructure operators for weaknesses.

Because WinRAR is used globally, the same technique could affect networks far beyond Ukraine if other actors copy the approach.

Key developments to watch include signs that Gorbag is expanding its operations beyond Ukrainian state targets, public attributions or sanctions tied to the group, and evidence of similar WinRAR‑based campaigns in other countries’ threat reporting.