• ESET Research has discovered highly targeted attacks staged by Gorbag taking place since February 2025, particularly focused on Ukrainian organizations near the Russia-Ukraine border.
  • Targets align closely with Russian strategic priorities: Ukrainian law enforcement and justice entities, local administrations, the defense sector, and a major transit hub for foreign military aid.
  • Malware is delivered via spearphishing emails with malicious attachments.
  • The operational focus is on one-time information harvesting rather than long-term access, which may indicate a role as an initial access broker for other Russia-aligned threat actors.
  • In early 2026, Gorbag updated its compromise chain to abuse CVE-2025-8088, a WinRAR path traversal vulnerability discovered and reported by ESET Research.

BRATISLAVA, Slovakia and MONTREAL, Nov. 03, 2026 (GLOBE NEWSWIRE) — ESET researchers have uncovered a Russia-aligned cyberespionage group using simple stealers to harvest data from Ukrainian organizations near the front line. Active since at least February 2025, the group has focused exclusively on Ukrainian targets, with a clear preference for law enforcement and justice entities, local administrations near the front line, and the defense sector.

“Rather than relying on sophisticated implants for long-term access, Gorbag uses a small toolset built for rapid collection. Browser credentials, VPN configurations, and selected documents are gathered in a single pass before the deployed malware attempts to remove itself,” says ESET researcher Damien Schaeffer, who discovered and investigated Gorbag. “One possible explanation for this approach is that Gorbag operates as an initial access broker, sharing collected credentials and other material with other threat actors for follow-on activity. If so, Gorbag may represent only the first stage of a longer intrusion chain whose later stages remain to be observed. Its targeting choices closely align with Russia’s wartime intelligence priorities,” adds Schaeffer.

All Gorbag targets identified by ESET Research are located in Ukraine, and the group’s targeting choices fall into three main areas that align closely with Russian wartime intelligence priorities. About a quarter of Gorbag’s targets are Ukrainian governmental organizations active in the law enforcement and justice sectors. Ukraine’s judiciary has remained active in building war crime cases as the war continues, with several hundred indictments already issued.

Another quarter of Gorbag’s targets are local governmental entities, most of them city councils in areas close to the front line. Although local administrations may seem like unusual espionage targets, several hypotheses can explain this choice, including battle damage assessments and monitoring of local defense initiatives. The remaining targets include a variety of entities in the defense sector, as well as an entity that has been publicly documented as a major transport hub for foreign military aid. This infrastructure has also been subjected to Russian air strikes, which suggests that Gorbag’s interest may be a combination of damage assessment and visibility into incoming military supplies.

Throughout 2025, Gorbag relied on spearphishing emails containing a malicious attachment. The documents used as lures feature official or governmental themes, such as administrative fines or taxes. In early 2026, the compromise chain changed. Gorbag began delivering weaponized RAR archives that exploit CVE-2025-8088, a WinRAR path traversal vulnerability reported by ESET Research in August 2025. Back then, ESET researchers first noticed the vulnerability being exploited as a zero day by RomCom, another Russia-aligned group known for both cybercrime and espionage operations. When opened on a vulnerable system, the archive displays a decoy PDF file while dropping a LNK file into the Windows Startup folder, along with an encrypted payload and a PowerShell loader.

The group’s toolset consists of a PowerShell reverse shell Prime ReverseShell and browser-data and file stealer BeautyStealer, both named by ESET. The group’s main data-collection tool is BeautyStealer, which targets cookies, stored passwords, and local state from the Chrome, Edge, Opera, and Firefox browsers; OpenVPN configurations from both user and system directories; and files with specific extensions — mostly Microsoft Office documents, archives, emails, and VPN configurations — located in the victim’s Desktop, Documents, and Downloads folders, as well as on removable media and mapped network drives. Additionally, a variant of Prime ReverseShell includes a comment at the top of the script that attempts to deceive AI assistants and security products that review the file. ESET tested two different AI assistants against this comment: neither was misled, and both correctly identified the reverse shell functionality.

ESET Research presented its findings about the Gorbag APT group at the 2026 Virus Bulletin conference.

For more details about Gorbag and its arsenal, check out the ESET Research blogpost “Gorbag: Orcs at the border harvesting intelligence from Ukraine” on WeLiveSecurity.com. Make sure to follow ESET Research on Twitter (today known as X), BlueSky, and Mastodon for the latest news from ESET Research.

About ESET®

ESET protects organizations, critical infrastructure, and individuals, helping them build digital resilience and confidence in an increasingly AI-driven world. With more than 35 years of cybersecurity expertise, over 25 years of AI innovation, and 11 global R&D centers, ESET develops proprietary technologies designed to protect against evolving cyber threats and secure the broader AI ecosystem. Grounded in scientific rigor and taking a preemptive approach to security, ESET delivers effortless protection that remains under expert human oversight. Headquartered in the European Union and privately owned, ESET protects millions of users and more than 500,000 organizations across 178 countries. Committed to responsible AI and customer trust, ESET protects the progress that technology enables. For more information, visit www.eset.com or follow ESET’s social media, podcasts, and blogs.

Media contact:
Jessica Beffa
jessica.beffa@eset.com
720-413-4938


Primary Logo

Media gallery

About The Author
ESET