Short answer: Russian hackers targeted Ukrainian agencies and military aid routes, stealing sensitive documents and login details. Stay alert and use strong passwords and security updates.
TL;DR
- Russian-linked hackers targeted Ukrainian agencies.
- Information on war crimes and military aid was stolen.
- Victims include government, law enforcement, and infrastructure.
- Use strong passwords and keep software updated.
What is CVE-2025-8088?
Russian hackers, known as Gorbag, targeted Ukrainian organizations involved in war crimes investigations and military aid. They used simple malware to steal documents and login details. The hackers focused on quick data collection and deletion, aligning with Russia's intelligence priorities. Victims included government bodies, law enforcement, and local councils near the front line. To protect yourself, use strong passwords and ensure your software is up to date.
- Malware
- Harmful software made to spy, steal or damage.
- Phishing
- Fake messages or websites that trick people into giving passwords or money.
Key facts
| Reported by | The Record |
|---|---|
| Date reported | 03 Nov 2026 |
| CVE | CVE-2025-8088 |
| CVSS | 8.4 HIGH CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| Weakness | CWE-35 (see NVD) |
| CISA KEV | Yes, added 2025-08-12; federal due date 2025-09-02 |
| Ransomware use | Known (CISA KEV) |
| Vendor advisory | arstechnica.com |
| Affected product | RARLAB WinRAR |
| Published in NVD | 2025-08-08 (CVE-2025-8088) |
How it works
A group called Gorbag, linked to Russia, uses simple malware to steal sensitive documents from Ukrainian agencies. They send phishing emails with fake documents that, when opened, steal passwords and other data. They prefer to quickly gather information and remove their traces.
- Attacker needs local access to the RARLAB WinRAR
- No login or account is needed
- A user must open a link or file first
- Sends crafted input that triggers the flaw
- Impact: data can be read, data or code can be changed, service crashes or stops
Skillmate analyst mapping (our judgement, not from the vendor):
- T1566 Phishing
Timeline
| Date | Event | Source |
|---|---|---|
| 2025-08-08 | CVE-2025-8088 published in NVD | NVD |
| 2025-08-12 | CVE-2025-8088 added to CISA KEV (actively exploited) | CISA KEV |
| 2025-09-02 | US federal agencies must patch by this date | CISA KEV |
| 2026-11-03 | Reported by The Record | The Record |
| 2026-11-07 | This Skillmate explainer published | Skillmate |
Am I affected?
These commands only read the version or settings. Compare the output with the vendor advisory linked in the facts table.
Microsoft Windows
PowerShell: lists the latest installed updates:
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10shows the Windows version and build:
winverHow to fix it
- Update RARLAB WinRAR to the fixed release named in the vendor advisory.
- Read the vendor advisory for CVE-2025-8088 and upgrade to the fixed release it lists.
- CVE-2025-8088 is in CISA KEV: treat it as actively exploited and patch first.
- If you cannot patch today, limit who can reach the affected service and watch its logs.
How to detect it
The hackers use a tool called BeautyStealer to steal files and cookies.
What is confirmed
- CVE-2025-8088 is a real NVD record scored 8.4 HIGH
- CISA lists CVE-2025-8088 as exploited in the wild
- Reported by The Record
Why it matters
This matters because such attacks can compromise sensitive data.
Learn the skills behind this story
Want to understand attacks like this and defend against them? Join Skillmate cybersecurity training or practise hands-on in Skillmate Labs.
FAQ
What is the main malware used by Gorbag?
The main malware used by Gorbag is called BeautyStealer, which searches for valuable files and deletes itself after stealing information.
How did Gorbag exploit CVE-2025-8088?
Gorbag exploited a path traversal vulnerability in WinRAR to execute arbitrary code by creating malicious archive files. This flaw was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET.
What kind of targets does Gorbag typically go after?
Gorbag targets Ukrainian government agencies, defense organizations, and infrastructure related to military aid, focusing on stealing sensitive documents and login credentials.
Sources
- Russia-linked cyber spies target Ukraine's war crimes investigations, military aid routes (The Record)
- Vendor advisory CVE-2025-8088 (arstechnica.com)
- NVD CVE record (NVD)
How we wrote this: facts come from the sources above, NVD and CISA KEV. An on-prem AI model drafted the plain-English parts and every sentence was checked against the sources; unsupported sentences were removed. MITRE mapping is our own judgement.
