ESET Identifies Gorbag: A Russia-Aligned Cyber Threat Targeting Ukraine

ESET researchers have identified a Russia-aligned threat actor named Gorbag, which has been active since at least February 2025. This group primarily targets Ukrainian organizations, particularly those in law enforcement, local administrations near the front line, and the defense sector.

Gorbag employs a limited toolset designed for rapid intelligence collection rather than sophisticated long-term access methods. The group uses a malware known as GIFTEDCROOK, attributed to UAC-0226, to harvest browser credentials, VPN configurations, and selected documents in a single pass. The malware is then designed to remove itself after data collection.

One possible explanation for Gorbag’s operational style is its role as an initial access broker, sharing the collected data with other threat actors for further exploitation. This aligns with Russia’s strategic intelligence priorities during the ongoing conflict.

Findings regarding Gorbag were presented at the Virus Bulletin conference on October 14, 2026, and a detailed technical analysis is available in ESET’s white paper titled “Gorbag: Orcs at the border.”

Targeting and Victimology

All identified targets of Gorbag are located in Ukraine, focusing on three main areas that reflect Russian wartime intelligence interests. Approximately 25% of the group’s targets are governmental organizations involved in law enforcement and justice. This focus is consistent with previous reports of Russian-aligned threat actors attempting to compromise Ukrainian law enforcement entities.

The motivations behind these attacks likely include monitoring efforts to document and prosecute war crimes committed by Russian forces and gaining insights into investigations targeting Russian assets within Ukraine. Gorbag’s initial activity against a Ukrainian justice entity was recorded in late March 2025.

Another 25% of Gorbag’s targets consist of local governmental entities, primarily city councils near the front line. These councils are responsible for reporting damage from Russian airstrikes and overseeing local defense initiatives, making them valuable sources of intelligence for Russian military leadership.

The remaining targets include various entities in the defense sector and a major transportation hub for foreign military aid, indicating Gorbag’s interest in assessing damage and monitoring military supplies.

Operational Methods and Tools

Gorbag’s operations rely on a straightforward set of tools. The group initially used spearphishing emails with malicious attachments, often disguised as official documents. These emails aimed to deceive recipients into enabling macros in Excel spreadsheets, which would execute a payload known as BeautyStealer, the group’s primary data-harvesting tool.

In early 2026, Gorbag shifted its compromise chain to exploit CVE-2025-8088, a WinRAR path traversal vulnerability. This change allowed the group to deliver weaponized RAR archives that extracted data outside the user-selected directory upon being opened on vulnerable systems.

BeautyStealer, a C++ browser-data and file stealer, targets various file types and credentials stored in browsers. It has evolved through several versions, enhancing its capabilities and methods of exfiltration. Stolen data is compressed and sent to an attacker-controlled Telegram chat or a custom command-and-control server.

Gorbag’s focus on short-term information harvesting, rather than maintaining long-term access, suggests a strategic approach to cyberespionage that prioritizes immediate intelligence collection over persistent control of compromised systems.

The detailed analysis of Gorbag’s operations, including the evolution of BeautyStealer and its compromise chain, is available in ESET’s white paper, “Gorbag: Orcs at the border.”

Source: ESET WeLiveSecurity