A newly identified hacking group, linked to Russia, has been targeting Ukrainian governmental and defense sectors. According to cybersecurity firm ESET, this group known as Gorbag has been operational since February 2025. They focus on exploiting vulnerabilities to steal sensitive documents and credentials from Ukrainian organizations, particularly those near the front line and the Russian border.
Unlike more sophisticated espionage units, Gorbag is noted for its swift operations. They steal information quickly and remove traces of their presence. Their targets align closely with Russian intelligence priorities, including monitoring investigations into alleged Russian war crimes and assessing the impact of Russian military actions. Approximately a quarter of Gorbag's targets are Ukrainian law enforcement and judicial bodies, which may be involved in war crime investigations and identifying Russian operatives.
Another significant focus is on local government agencies, especially city councils near conflict zones. These institutions gather crucial data on damage from Russian strikes. Access to this information could allow Russian forces to gauge the success of their attacks. Additionally, Gorbag targets include defense organizations and a key transportation hub for foreign military aid, which has previously faced Russian airstrikes.
Gorbag employs phishing emails with malicious attachments to infiltrate systems. These attachments often masquerade as official documents. Upon opening, hackers can extract passwords, VPN configurations, and files. Their main tool, BeautyStealer, examines computers and connected devices for valuable files before attempting self-deletion. Another tool, Prime ReverseShell, enables remote command execution on compromised systems.
In early 2026, Gorbag adapted its tactics to exploit a vulnerability in WinRAR, identified as CVE-2025-8088. This flaw allowed execution of malicious code and was patched in July 2025. Researchers suggest that Gorbag might collaborate with other groups, sharing stolen information for further exploitation. Despite its basic tools, Gorbag's precise targeting aligns with Russia's strategic goals in its ongoing conflict with Ukraine.
