{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Gorbag APT targets strategic Ukrainian entities for rapid intelligence harvesting. Credential theft and VPN configuration compromise can occur before standard alerts are reviewed; a phased hunt for the deployment chain is required for early containment." }, "name": "Gorbag APT Rapid Harvester Deployment", "type": "investigation", "labels": [ "hunt", "attack.t1566.001", "attack.t1203", "attack.t1059.001", "attack.t1547.001", "attack.t1027.009", "command and control", "credential access", "defense evasion", "execution", "initial access", "persistence" ], "series": { "slug": "gorbag-orcs-at-the-border-harvesting-intelligence-from-ukraine", "index": 1, "title": "Gorbag: Orcs at the border harvesting intelligence from Ukraine", "total": 2 }, "related": [ { "hunt": "gorbag-intelligence-exfiltration", "reason": "This hunt targets deployment; a follow-on hunt handles the network exfiltration and browser data theft.", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A single rule might miss transient files or the specific sequence of macro-execution leading to Startup folder persistence. This hunt links vulnerability context with behavioral pivots to provide a high-confidence narrative for containment.", "coverage": [ { "stage": "spearphishing-delivery", "steps": [ "specific-lure-detection", "agent-delivery-read" ], "status": "covered" }, { "stage": "exploit-winrar-traversal", "steps": [ "scoping-vulnerable-winrar", "rare-programdata-drops" ], "status": "covered" }, { "stage": "dropper-execution-vba-ps", "steps": [ "rare-programdata-drops", "powershell-loader-logic" ], "status": "covered" }, { "stage": "startup-persistence", "steps": [ "startup-lnk-persistence" ], "status": "covered" }, { "stage": "browser-intel-harvesting", "reason": "Belongs to another part of the 'Gorbag: Orcs at the border harvesting intelligence from Ukraine' series.", "status": "out_of_scope" }, { "stage": "network-c2-and-exfiltration", "reason": "Belongs to another part of the 'Gorbag: Orcs at the border harvesting intelligence from Ukraine' series.", "status": "out_of_scope" }, { "stage": "post-intrusion-cleanup", "reason": "Belongs to another part of the 'Gorbag: Orcs at the border harvesting intelligence from Ukraine' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Spearphishing with Malicious Lures", "slug": "spearphishing-delivery", "tactic": "initial-access", "techniques": [ "T1566.001", "T1199" ], "observables": [ "\u0434\u043e\u0434\u0430\u0442\u043e\u043a \u043f\u043e\u0434\u0430\u0442\u043a\u043e\u0432\u0430.xlsm", "\u041f\u043e\u0432\u0456\u0434\u043e\u043c\u043b\u0435\u043d\u043d\u044f 4726-49.rar", "Email subjects regarding administrative fines or taxes" ] }, { "name": "WinRAR Path Traversal Exploitation", "slug": "exploit-winrar-traversal", "tactic": "execution", "techniques": [ "T1203" ], "observables": [ "CVE-2025-8088", "Extraction of alternate data streams outside directory", "LNK file written to Startup folder" ] }, { "name": "Macro or PowerShell Dropper Execution", "slug": "dropper-execution-vba-ps", "tactic": "execution", "techniques": [ "T1059.001", "T1027.009" ], "observables": [ "VBA decoding base64 from Excel cells", "Payload dropped into %ProgramData%", "PowerShell loader in %ProgramData%" ] }, { "name": "Persistence via Startup Folder", "slug": "startup-persistence", "tactic": "persistence", "techniques": [ "T1547.001" ], "observables": [ "LNK file in %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup" ] }, { "name": "Rapid Browser and VPN Data Theft", "slug": "browser-intel-harvesting", "tactic": "credential-access", "techniques": [ "T1555.003", "T1539", "T1217", "T1005" ], "observables": [ "BeautyStealer access to browser profile databases", "Collection of VPN configurations", "Staging of documents for exfiltration" ] }, { "name": "C2 and Telegram Exfiltration", "slug": "network-c2-and-exfiltration", "tactic": "command-and-control", "techniques": [ "T1071.001", "T1567", "T1048.001" ], "observables": [ "HTTPS connection to 89.44.9.186 (Prime ReverseShell)", "Exfiltration to 142.111.194.73", "Data exfiltration via Telegram API", "RC4 encrypted payloads" ] }, { "name": "Self-Deletion Cleanup", "slug": "post-intrusion-cleanup", "tactic": "defense-evasion", "techniques": [ "T1070.004" ], "observables": [ "Malware binary removal from %ProgramData% after single pass execution" ] } ], "summary": "Gorbag is a Russia-aligned threat actor targeting Ukrainian law enforcement and defense sectors since 2025. They utilize spearphishing with macro-enabled spreadsheets or WinRAR exploits (CVE-2025-8088) to deploy BeautyStealer for rapid credential and file harvesting and Prime ReverseShell for command and control before performing self-deletion." }, "severity": "high", "rationale": "Prioritize endpoints in the defense, law enforcement, and local administration sectors. Focus on hosts with identified vulnerabilities to CVE-2025-8088.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An intruder has deployed the Gorbag compromise chain by exploiting a WinRAR vulnerability or using macro-enabled lures to drop transient harvesters into ProgramData and establish startup folder persistence.", "parameters": { "cve_id": { "type": "string", "default": "CVE-2025-8088", "description": "The WinRAR path traversal vulnerability identifier used by Gorbag." }, "lure_names": { "from": { "ref": "https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/", "kind": "article", "observed": "2026-11-03" }, "type": "list[string]", "default": [ "\u0434\u043e\u0434\u0430\u0442\u043e\u043a \u043f\u043e\u0434\u0430\u0442\u043a\u043e\u0432\u0430.xlsm", "\u041f\u043e\u0432\u0456\u0434\u043e\u043c\u043b\u0435\u043d\u043d\u044f 4726-49.rar" ], "description": "Filenames of the malicious lures identified in the report." }, "scope_hosts": { "type": "list[host]", "default": [], "description": "Optional list of hostnames to focus the behavioral queries, usually provided after the scoping step." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/", "gates": [ "dry-run", "lint", "critic" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/", "name": "Gorbag: Orcs at the border harvesting intelligence from Ukraine" } ], "blind_spots": [ { "id": "missing-script-telemetry", "risk": "Without script block logging, the in-memory execution phase of the Prime loader remains a blind spot.", "stage": "dropper-execution-vba-ps", "question": "whether the PowerShell loader executed its base64-encoded logic", "requires": "hb_script_activity (PowerShell Event 4104)" }, { "id": "ephemeral-tool-cleanup", "risk": "Gorbag tools are designed for rapid harvesting and cleanup. payloads may only be visible as historical file creation events.", "question": "whether the harvester has already deleted itself from ProgramData", "requires": "hb_file_activity deletion events" } ] }, "name": "Gorbag APT Rapid Harvester Deployment", "description": "This hunt targets the initial deployment phase of the Russia-aligned Gorbag group. The actor uses spearphishing lures or weaponized archives exploiting CVE-2025-8088 to drop payloads like BeautyStealer or Prime ReverseShell. The hunt follows a phased approach: first, it identifies vulnerable hosts and examines the file surface for lure delivery and rare dropper activity in ProgramData; second, it corroborates these findings by looking for Startup folder persistence and PowerShell loader script blocks. This sequence allows an analyst to distinguish between routine file activity and the specific, multi-stage delivery pattern of an ephemeral intelligence harvester that removes itself after execution." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "gorbag-orcs-at-the-border-harvesting-intelligence-from-ukraine", "index": 1, "title": "Gorbag: Orcs at the border harvesting intelligence from Ukraine", "total": 2 }, "coverage": [ { "stage": "spearphishing-delivery", "steps": [ "specific-lure-detection", "agent-delivery-read" ], "status": "covered" }, { "stage": "exploit-winrar-traversal", "steps": [ "scoping-vulnerable-winrar", "rare-programdata-drops" ], "status": "covered" }, { "stage": "dropper-execution-vba-ps", "steps": [ "rare-programdata-drops", "powershell-loader-logic" ], "status": "covered" }, { "stage": "startup-persistence", "steps": [ "startup-lnk-persistence" ], "status": "covered" }, { "stage": "browser-intel-harvesting", "reason": "Belongs to another part of the 'Gorbag: Orcs at the border harvesting intelligence from Ukraine' series.", "status": "out_of_scope" }, { "stage": "network-c2-and-exfiltration", "reason": "Belongs to another part of the 'Gorbag: Orcs at the border harvesting intelligence from Ukraine' series.", "status": "out_of_scope" }, { "stage": "post-intrusion-cleanup", "reason": "Belongs to another part of the 'Gorbag: Orcs at the border harvesting intelligence from Ukraine' series.", "status": "out_of_scope" } ], "rationale": "An intruder has deployed the Gorbag compromise chain by exploiting a WinRAR vulnerability or using macro-enabled lures to drop transient harvesters into ProgramData and establish startup folder persistence.", "blind_spots": [ { "id": "missing-script-telemetry", "risk": "Without script block logging, the in-memory execution phase of the Prime loader remains a blind spot.", "stage": "dropper-execution-vba-ps", "question": "whether the PowerShell loader executed its base64-encoded logic", "requires": "hb_script_activity (PowerShell Event 4104)" }, { "id": "ephemeral-tool-cleanup", "risk": "Gorbag tools are designed for rapid harvesting and cleanup. payloads may only be visible as historical file creation events.", "question": "whether the harvester has already deleted itself from ProgramData", "requires": "hb_file_activity deletion events" } ], "scoping_notes": "Prioritize endpoints in the defense, law enforcement, and local administration sectors. Focus on hosts with identified vulnerabilities to CVE-2025-8088.", "beyond_detection": "A single rule might miss transient files or the specific sequence of macro-execution leading to Startup folder persistence. This hunt links vulnerability context with behavioral pivots to provide a high-confidence narrative for containment." } }, { "id": "scoping-vulnerable-winrar", "type": "query", "label": "Identify hosts vulnerable to WinRAR traversal", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_uid, resource_uid, cve_uid, severity, title FROM hb_vulnerability_finding WHERE cve_uid = '{{cve_id}}' AND status != 'suppressed'", "surface": "hb_vulnerability_finding", "description": "Find endpoints currently reporting the WinRAR vulnerability (CVE-2025-8088) to prioritize the behavioral hunt.", "expected_signal": "Rows identify devices with vulnerable versions of WinRAR. Silence means the specific vulnerability was not detected by scanners in this estate." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify hosts vulnerable to WinRAR traversal", "reads": [ "device_uid", "resource_uid", "cve_uid", "severity", "title" ], "source": "hb_vulnerability_finding", "target": "endpoint", "content": "SELECT device_uid, resource_uid, cve_uid, severity, title FROM hb_vulnerability_finding WHERE cve_uid = '{{cve_id}}' AND status != 'suppressed'", "silence": "not_evidence_of_absence", "expected": "Rows identify devices with vulnerable versions of WinRAR. Silence means the specific vulnerability was not detected by scanners in this estate.", "verified": "dry-run", "verified_at": "2026-11-04" } }, { "id": "specific-lure-detection", "type": "query", "label": "Detection of specific spearphishing lures", "config": { "dsl": "sqlite", "role": "triage", "source": "endpoint", "content": "SELECT device_hostname, file_name, file_path, process_name, time FROM hb_file_activity WHERE instr(',' || '{{lure_names}}' || ',', ',' || LOWER(file_name) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_file_activity", "description": "Match the exact filenames used in the Gorbag campaign in recent file activity.", "expected_signal": "A file matching a lure name landing on a host. Silence means these specific file names were not observed." }, "parents": [ { "id": "scoping-vulnerable-winrar" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "Detection of specific spearphishing lures", "reads": [ "device_hostname", "file_name", "file_path", "process_name", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, file_name, file_path, process_name, time FROM hb_file_activity WHERE instr(',' || '{{lure_names}}' || ',', ',' || LOWER(file_name) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A file matching a lure name landing on a host. Silence means these specific file names were not observed.", "verified": "dry-run", "verified_at": "2026-11-04" } }, { "id": "rare-programdata-drops", "type": "query", "label": "Rare file drops in ProgramData from suspect parents", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT LOWER(file_name) AS dropped_file, process_name, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_file_activity WHERE activity_id = 1 AND (LOWER(process_name) LIKE '%excel.exe' OR LOWER(process_name) LIKE '%winrar.exe') AND LOWER(file_path) LIKE '%\\programdata\\%' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY dropped_file, process_name HAVING hosts <= 3", "surface": "hb_file_activity", "description": "Identify behavioral indicators where Excel or WinRAR drop rare files into the ProgramData directory.", "expected_signal": "A rare file created in ProgramData by a productivity or archiving application. Silence suggests no such drops occurred within the window." }, "parents": [ { "id": "scoping-vulnerable-winrar" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Rare file drops in ProgramData from suspect parents", "reads": [ "file_name", "process_name", "device_hostname", "file_path", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT LOWER(file_name) AS dropped_file, process_name, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_file_activity WHERE activity_id = 1 AND (LOWER(process_name) LIKE '%excel.exe' OR LOWER(process_name) LIKE '%winrar.exe') AND LOWER(file_path) LIKE '%\\programdata\\%' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY dropped_file, process_name HAVING hosts <= 3", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A rare file created in ProgramData by a productivity or archiving application. Silence suggests no such drops occurred within the window.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "dropped_file", "process_name" ], "rare_below": 3 }, "verified_at": "2026-11-04" } }, { "id": "agent-delivery-read", "type": "analytic", "label": "Evaluate delivery evidence", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "scoping-vulnerable-winrar", "specific-lure-detection", "rare-programdata-drops" ], "objective": "Decide whether any host shows evidence of a successful Gorbag delivery based on lure file presence or anomalous ProgramData dropper behavior.", "description": "Analyze whether the initial delivery evidence from lures and rare drops warrants a follow-on persistence check.", "max_iterations": 3, "expected_signal": "A verdict on whether delivery activity is suspicious on a per-host basis.", "success_criteria": "A suspicious/malicious verdict if specific lures are found or if Office/WinRAR drop rare payloads on vulnerable hosts." }, "parents": [ { "id": "specific-lure-detection", "kind": "merge" }, { "id": "rare-programdata-drops", "kind": "merge" } ] }, { "id": "startup-lnk-persistence", "type": "query", "label": "Creation of Startup folder LNK files", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, file_name, file_path, process_name, time FROM hb_file_activity WHERE activity_id = 1 AND LOWER(file_path) LIKE '%\\start menu\\programs\\startup\\%' AND LOWER(file_name) LIKE '%.lnk' AND (LOWER(process_name) LIKE '%winrar.exe' OR LOWER(process_name) LIKE '%powershell.exe') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_file_activity", "description": "Identify persistence established via the Windows Startup folder, dropped by WinRAR or PowerShell.", "expected_signal": "A LNK file landing in the Startup directory. Silence is expected if the threat actor only performed one-time harvesting." }, "parents": [ { "id": "agent-delivery-read" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Creation of Startup folder LNK files", "reads": [ "device_hostname", "file_name", "file_path", "process_name", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, file_name, file_path, process_name, time FROM hb_file_activity WHERE activity_id = 1 AND LOWER(file_path) LIKE '%\\start menu\\programs\\startup\\%' AND LOWER(file_name) LIKE '%.lnk' AND (LOWER(process_name) LIKE '%winrar.exe' OR LOWER(process_name) LIKE '%powershell.exe') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A LNK file landing in the Startup directory. Silence is expected if the threat actor only performed one-time harvesting.", "verified": "dry-run", "verified_at": "2026-11-04" } }, { "id": "powershell-loader-logic", "type": "query", "label": "PowerShell loader script patterns", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, script_content, script_path, time FROM hb_script_activity WHERE (LOWER(script_content) LIKE '%frombase64string%' AND LOWER(script_content) LIKE '%programdata%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_script_activity", "description": "Find script blocks that decode base64 content and reference the ProgramData directory, matching the Prime loader behavior.", "expected_signal": "A PowerShell script block performing decoding to stage a payload from ProgramData. Silence means no such script patterns were logged." }, "parents": [ { "id": "agent-delivery-read" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "PowerShell loader script patterns", "reads": [ "device_hostname", "script_content", "script_path", "time" ], "source": "hb_script_activity", "target": "endpoint", "content": "SELECT device_hostname, script_content, script_path, time FROM hb_script_activity WHERE (LOWER(script_content) LIKE '%frombase64string%' AND LOWER(script_content) LIKE '%programdata%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A PowerShell script block performing decoding to stage a payload from ProgramData. Silence means no such script patterns were logged.", "verified": "dry-run", "verified_at": "2026-11-04" } }, { "id": "agent-follow-on-read", "type": "analytic", "label": "Full intrusion chain triage", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "agent-delivery-read", "startup-lnk-persistence", "powershell-loader-logic" ], "objective": "Determine if the early delivery evidence combined with follow-on persistence or loader script blocks indicates a full Gorbag compromise chain.", "description": "Synthesize the evidence from delivery, persistence, and loader execution to confirm a Gorbag compromise.", "max_iterations": 6, "expected_signal": "A high-confidence verdict linking the delivery and persistence phases.", "success_criteria": "A verdict of malicious for any host where early stage drops are followed by Startup persistence or specific PowerShell loader script patterns." }, "parents": [ { "id": "startup-lnk-persistence", "kind": "merge" }, { "id": "powershell-loader-logic", "kind": "merge" } ] }, { "id": "intrusion-decision", "type": "checkpoint", "label": "Decide on intrusion status", "config": { "fuzzy": true, "judge": "hunter", "question": "the agent-follow-on-read verdict is malicious for at least one host", "condition": "the agent-follow-on-read verdict is malicious for at least one host", "blind_spot": "missing-script-telemetry", "confidence": "high", "description": "Route the findings to containment or analyst investigation based on the agent's full chain analysis.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "agent-follow-on-read" } ] }, { "id": "isolate-compromised-host", "type": "action", "label": "Isolate compromised host", "config": { "target": "endpoint", "description": "Network-isolate the affected endpoints to prevent exfiltration and preserve evidence.", "instructions": "Isolate the endpoint from the network and preserve the ProgramData and Startup folder artifacts for forensic analysis.", "action_approval": "required" }, "parents": [ { "id": "intrusion-decision", "branch": "on_supports" } ] }, { "id": "analyst-verification-task", "type": "task", "label": "Analyst forensic verification", "config": { "assignee": "analyst", "description": "Verify the agent's findings and extract indicators from any dropped payloads.", "instructions": "Examine the LNK file and payloads in ProgramData. Confirm if they match the RC4-encrypted patterns or the PowerShell loader behavior described in the ESET article. Check the USN journal if files have been deleted." }, "parents": [ { "id": "intrusion-decision", "branch": "default" }, { "id": "intrusion-decision", "branch": "on_unavailable" }, { "id": "isolate-compromised-host" } ] }, { "id": "close-out", "type": "task", "label": "Hunt close-out", "config": { "assignee": "analyst", "description": "Document findings and update the detection library based on hunt results.", "instructions": "Record the results. If malicious activity was confirmed, escalate to Incident Response. Promote the rare ProgramData drop query to a standing detection rule." }, "parents": [ { "id": "intrusion-decision", "branch": "on_refutes" }, { "id": "analyst-verification-task" } ] } ] }