A previously underreported Russia-aligned group dubbed Gorbag has conducted targeted cyberespionage operations against Ukrainian justice agencies, frontline local governments, defense organizations and a major foreign military-aid transport hub since at least February 2025, according to ESET Research. The campaign appears designed for rapid intelligence collection rather than sustained access, with targeting that researchers say is consistent with Russian wartime priorities.
About one-quarter of the identified victims were law-enforcement or justice organizations, while another quarter were local authorities, mostly city councils near the front line. ESET said the data could help monitor war-crimes investigations, assess damage from Russian strikes or expose local defense activity. Other victims included defense-sector organizations and infrastructure associated with the movement of foreign military aid. The attribution is assessed as Russia-aligned rather than publicly tied to a named Russian intelligence service.
During 2025, Gorbag relied on spear-phishing messages carrying official-looking lures, including administrative-fine and tax themes. Malicious macro-enabled Excel files could decode and execute an embedded payload after a victim enabled macros. ESET identified a PowerShell reverse shell, which it named Prime ReverseShell, before the group shifted toward its primary data-theft tool, BeautyStealer.
BeautyStealer is a C++ infostealer that harvests browser cookies, stored passwords and local data from Chrome, Edge, Opera and Firefox. It also searches for OpenVPN configurations and selected documents, archives, email files, remote-desktop data and credential-related files on local, removable and mapped network storage. The malware compresses and exfiltrates the material through Telegram or an attacker-controlled server, then attempts to delete itself. ESET said the one-time collection model may indicate that Gorbag supplies credentials or stolen data to other Russia-aligned operators, although that role remains an assessment rather than a confirmed finding.
In early 2026, the group began using weaponized RAR archives exploiting CVE-2025-8088, a Windows WinRAR path-traversal vulnerability. The flaw allows a crafted archive to write files outside the user-selected extraction directory and can enable code execution; NVD rates it 8.8 High under CVSS 3.1, while the record lists an 8.4 CVSS 4.0 score from ESET. The vulnerability affects WinRAR versions through 7.12 and is fixed in version 7.13, according to NVD. CISA added it to the Known Exploited Vulnerabilities catalog on Aug. 12, 2025, confirming exploitation in the wild. [17][16]
Organizations supporting Ukrainian government, justice and defense operations should urgently update Windows installations of WinRAR and related vulnerable components to 7.13 or later, block or quarantine unsolicited archives and macro-enabled documents, and treat browser, VPN and session-cookie theft as an account-compromise event. Defenders should also review email-account abuse, Startup-folder persistence, PowerShell activity and unusual Telegram or outbound archive traffic. ESET linked the activity to tooling previously associated with CERT-UA’s UAC-0226 cluster, but the broader Gorbag grouping and its Russia alignment remain the researchers’ assessment. [1]
References
- Gorbag: Orcs at the border harvesting intelligence from Ukraine
- CISA Adds Three Known Exploited Vulnerabilities to Catalog
- NVD-CVE-2025-8088
