BeautyStealer packages browser data, VPN configuration, documents and credential containers, sends the archive away, then attempts to erase itself from the host.
A Russia-aligned cluster targeting Ukrainian government, justice, defense and front-line administrative organizations has refined information theft into a short collection mission. ESET’s November 3 research describes Gorbag delivering BeautyStealer through spearphishing, collecting browser data, VPN configuration and selected files, archiving the material, sending it to attacker-controlled infrastructure and attempting to delete the malware from the host.
The collection list is the operational plan. It combines the contents of a workstation with the identity material and network configuration that can explain where the user connects next. One successful run can give an intelligence operator a compact map of a person’s documents, accounts, remote-access paths and adjacent systems.
ESET reports that BeautyStealer collects browser data, VPN configurations and selected files, packages the material for exfiltration, and attempts to delete itself after the run.
The lure only has to win once
Gorbag’s delivery changed while the collection goal stayed consistent. ESET says the group used official- and government-themed spearphishing attachments, sometimes sent from compromised Ukrainian government email accounts. In 2025, observed chains included macro-enabled Excel files whose embedded code reconstructed and ran a payload.
Campaigns observed from early 2026 used weaponized RAR archives and CVE-2025-8088, a WinRAR path-traversal flaw patched in version 7.13 in July 2025. On a vulnerable system, the archive could show the recipient a decoy document while placing a shortcut in the Windows Startup folder and staging a PowerShell loader and encrypted payload elsewhere on disk. Trend Micro separately tied exploitation of the same flaw to activity it tracks as SHADOW-EARTH-066.
This is a narrow, targeted delivery chain. The attachment creates the execution opportunity; the startup shortcut and loader turn that opportunity into a collection run.
ESET describes delivery through spearphishing attachments; later Gorbag campaigns used weaponized RAR archives against systems still vulnerable to CVE-2025-8088.
The collection list is a mission profile
BeautyStealer’s browser targets included cookies, stored passwords, local-state data and browsing history from Chrome, Edge, Opera and Firefox. Its file collection reached OpenVPN and remote-desktop configuration, KeePass databases, email and archive formats, and selected documents in common user folders. ESET also observed versions searching removable media and mapped network drives.
Together, those artifacts answer three useful intelligence questions:
Which services and identities does this user touch?
Which remote paths connect this workstation to other environments?
Which documents reveal current work, relationships or operational priorities?
The capability list describes what the malware was built to seek across observed versions. It does not establish that every category existed on every target or that every collected credential remained usable. Public reporting also does not show a successful downstream login or a broader organizational breach.
That boundary matters because the responder still has to scope every reachable category. A missing confirmed login is not a reason to leave a captured browser session, VPN profile or private key in service.
The archive outlives the payload
ESET observed BeautyStealer compressing the collected material before exfiltration. Some versions used Telegram’s document-delivery interface; later versions sent archives to a custom command-and-control service built with FastAPI. After the collection mission, the malware attempted to remove itself.
Self-deletion changes the evidence available on the endpoint. It leaves the exported archive available for analysis somewhere else. My assessment is that this design optimizes for a clean, repeatable intelligence pickup rather than a noisy resident foothold.
ESET raises the possibility that Gorbag could pass collected material to another actor for later exploitation. The public evidence does not show that handoff. Responders should treat it as a planning scenario and use access logs to determine whether any stolen artifact was replayed.
ESET observed archive delivery through Telegram and, in later versions, a custom FastAPI server. The public report describes cleanup after exfiltration, while later use of the collected material remains unobserved.
One cluster, three tracking labels
ESET names the cluster Gorbag and assesses it as Russia-aligned based on targeting, tooling and campaign context. CERT-UA tracks related GIFTEDCROOK activity as UAC-0226. Trend Micro uses SHADOW-EARTH-066 for overlapping activity involving the WinRAR exploit chain.
Those labels should remain source-specific. The public reporting supports overlap in tooling and campaigns; it does not make every event under all three names identical. CERT-UA’s 2025 advisory documented the activity without assigning it to a Russian service, and the available evidence does not support naming a specific intelligence agency.
Reconstruct the collection window
The first response question is what the process could reach before it left.
I would work from four evidence sets:
Delivery and execution: preserve the attachment, archive and mail metadata; identify vulnerable WinRAR installations; review Startup-folder shortcuts, loader artifacts and the relevant process tree.
Collection scope: enumerate browser profiles, VPN and remote-desktop configuration, credential containers, selected document locations, removable media and mapped drives accessible to the affected account.
Artifact invalidation: from a clean system, reset exposed credentials, revoke relevant web sessions, replace reachable keys and VPN material, and review secrets stored beside the user’s documents or browser profile.
Replay and movement: search identity, VPN, email, cloud and remote-access logs for use that departs from the user’s normal time, device and network patterns. Scope those checks to every identity and route identified in the collection review.
Response scope should cover the host and the identity material BeautyStealer could reach: browser profiles, VPN and remote-desktop configuration, credential containers, selected files, removable media and mapped drives.
BeautyStealer’s technical simplicity compresses the response clock. The useful work begins with reconstructing the archive it was positioned to build, then invalidating each route before the stolen map becomes the starting point for another intrusion.