Gorbag, a cyberespionage group aligned with Russian interests, has been targeting Ukrainian law enforcement, local governments, and defense organizations since February 2025.
The group employs spear-phishing tactics, using malicious attachments disguised as official documents to deliver malware. Recent attacks have exploited a vulnerability in WinRAR (CVE-2025-8088) to deploy their malware.
Gorbag's primary information-stealing tool, BeautyStealer, collects data from web browsers and other sources. Their toolset also includes a PowerShell reverse shell named Prime ReverseShell and a C/C++ stealer called GIFTEDCROOK. These tools facilitate the group's focus on one-time information harvesting.
About a quarter of Gorbag's targets are Ukrainian law enforcement and judicial institutions. Another quarter of the group's targets are local administrations, mostly city councils in areas close to the front line.
Cybersecurity firms, including ESET and Trend Micro, have confirmed Gorbag's operations. The group may act as an initial access broker, potentially sharing stolen data with other threat actors for further exploitation.