ESET ties new group Gorbag to phishing and WinRAR attacks on Ukrainian agencies
The Russia-aligned group has been active since at least February 2025, stealing documents and credentials from law enforcement, local councils and a transport hub for foreign military aid.
ESET published a report on Tuesday describing a Russia-aligned group it calls Gorbag, active since at least February 2025, which has been breaking into Ukrainian government agencies, defense organizations and infrastructure used to move foreign military aid.
The tooling is not fancy. Gorbag mostly sends phishing emails with malicious attachments dressed up as official documents about administrative fines or taxes. Opening one lets the group pull saved browser passwords, cookies, VPN configurations and selected files: Office documents, email records, archives. Its main stealer, BeautyStealer, hunts for files on the machine, on removable drives and on connected network drives, then tries to delete itself after sending the loot out. A second tool, Prime ReverseShell, is adapted from public code and gives the attackers remote command execution.
About a quarter of known targets are Ukrainian law enforcement and judicial institutions, and another quarter are local government bodies, mostly city councils near the front line. ESET says the records those bodies hold, including damage assessments and repair estimates that aren't published, could help Russian forces judge how well strikes worked. One target is described as a major transport hub for foreign military assistance; ESET didn't name it.
In early 2026 the group switched methods and exploited a previously disclosed WinRAR flaw, tracked as CVE-2025-8088, which lets an attacker run code when a victim opens a crafted archive. That bug was patched in July 2025 and had already been used by RomCom, another Russia-aligned group.
ESET says Gorbag grabs what it can and clears out rather than sitting in networks for months, which might mean it hands stolen credentials and documents to other operators. The researchers haven't established that any such cooperation happens.
For defenders in the region, the phishing lure is the part to watch: attachments posing as tax or fine paperwork. Anyone still running an unpatched WinRAR on Windows should treat that as the easier fix of the two.
CVE references
Sources
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning