A cyber threat group known as Gorbag, aligned with Russian interests, has been actively targeting Ukrainian organizations with information-stealing malware. Since February 2025, Gorbag has focused its attacks on Ukrainian law enforcement, justice departments, and defense sectors. This group uses a variety of tools, including the GIFTEDCROOK malware, which is capable of extracting sensitive data from web browsers such as Google Chrome, Microsoft Edge, and Mozilla Firefox.

The group has leveraged a vulnerability in WinRAR, identified as CVE-2025-8088, to execute a DLL sideloading chain that runs the GIFTEDCROOK malware. The malware not only steals browser data but also collects VPN configurations and documents, potentially acting as an initial access broker for further cyber espionage activities. Gorbag employs spear-phishing tactics using emails with government-themed lures to spread the malware. One of the payloads used is BeautyStealer, which harvests data from various sources including browsers, OpenVPN configurations, and Microsoft Office documents.

Once the data is collected, it is compressed and sent to a Telegram chat or a custom server controlled by the attackers. BeautyStealer then self-destructs, indicating a focus on one-time data collection rather than persistent access. According to ESET researcher Damien Schaeffer, BeautyStealer is an evolved version of GIFTEDCROOK and has been the primary tool used by Gorbag since late 2025. The group also employed Prime ReverseShell, a reverse shell tool flagged by CERT-UA, though attempts to obfuscate its malicious intent using deceptive comments were unsuccessful in real-world testing.

Schaeffer notes that Gorbag's operations demonstrate that even simple malware tools can be effective in cyber espionage campaigns, highlighting the wartime intelligence priorities of Russia.