Summary
- Gorbag has operated against Ukrainian organisations since at least February 2025.
- The group collects credentials, VPN configurations, and selected files using a relatively limited malware toolkit.
- Researchers suspect the stolen information could support subsequent activity by other threat actors, but that relationship remains unconfirmed.
A Russia-aligned cyberespionage group has been targeting Ukrainian law enforcement, government, and defence organisations through phishing campaigns designed to collect credentials and sensitive documents without maintaining prolonged access to compromised networks.
Researchers at ESET have identified the group as Gorbag and traced its activity to at least February 2025. The investigation describes an operation concentrating on Ukrainian institutions with direct relevance to the country’s continuing war with Russia.
Targets include justice and law enforcement bodies, local government organisations near the front line, defence-related institutions, and a major transportation hub associated with foreign military assistance.
The group’s operating model relies on relatively simple information-stealing tools that gather selected material before attempting to remove themselves from the affected systems. This reduces the need for sustained malware activity while still allowing attackers to obtain information that may remain useful after the initial intrusion.
Phishing delivers targeted information theft
Gorbag’s campaigns have used spearphishing emails carrying malicious attachments, with the selected recipients reflecting the group’s interest in specific government and military functions.
Its known tooling includes a PowerShell reverse shell identified by ESET as Prime ReverseShell and a C++ information stealer called BeautyStealer.
Once activated, the tools can collect browser credentials, virtual private network configurations, and selected files. The malware’s emphasis on rapid collection distinguishes the observed operation from espionage campaigns built around maintaining access for extended periods.
ESET also identified connections between elements of Gorbag’s tooling and the previously documented GIFTEDCROOK information stealer. Ukraine’s computer emergency response team has attributed GIFTEDCROOK activity to the cluster tracked as UAC-0226.
Those technical relationships do not establish that every activity associated with Gorbag and UAC-0226 was conducted by an identical set of operators. Shared tools and overlapping infrastructure can support attribution assessments, but the available evidence must be considered alongside targeting and operational behaviour.
During early 2026, Gorbag modified part of its infection process to exploit CVE-2025-8088, a path traversal vulnerability in WinRAR. The change provided another means of executing malicious content through a commonly installed application.
Despite that adjustment, the group’s broader objectives remained focused on acquiring information rather than disrupting systems or deploying destructive malware.
Targeting reflects wartime intelligence requirements
Ukrainian law enforcement and justice institutions hold information relating to investigations, criminal proceedings, and activity in areas affected by the conflict. Such records can have intelligence value independently of the organisations’ direct role in military operations.
Local administrations near the front line also maintain information about public facilities, infrastructure, services, and the consequences of military activity. Access to those records may assist an adversary seeking to understand conditions in particular locations.
Defence organisations and logistics infrastructure present a different collection opportunity. Even where an attacker cannot alter the movement of equipment, records describing facilities, personnel, or operational arrangements may assist broader intelligence assessments.
The selection of a transportation hub associated with foreign military assistance is consistent with the group’s wider interest in organisations supporting Ukraine’s defence.
Although the individual targets differ, the use of phishing and rapid information theft provides a common method for collecting material across these sectors.
Possible connections to wider operations
ESET considers it possible that Gorbag operates as an initial access broker or information collection component supplying other Russia-aligned actors.
Under such an arrangement, an initial intrusion could provide credentials or documents that another group subsequently uses for espionage or further access. The original malware might disappear from the victim’s systems before additional activity begins.
However, ESET has not confirmed that Gorbag transferred stolen information to another operator or established a direct chain between its intrusions and later attacks.
The absence of documented follow-on activity therefore limits conclusions about the group’s place within Russia-aligned cyber operations.
Gorbag’s targeting nevertheless demonstrates the continuing demand for intelligence from Ukrainian administrative and defence environments. The campaign relies on familiar intrusion methods while pursuing information closely associated with wartime activity.
ESET’s findings establish a sustained collection operation whose ultimate organisational relationships and downstream use of stolen information remain unresolved.
