ESET tracks Russia-aligned Gorbag targeting Ukrainian justice organizations and city councils

Since at least February 2025, ESET has followed the Russia-aligned actor Gorbag, and every identified target sits in Ukraine. Ukrainian governmental organizations in law enforcement and justice make up about a quarter of Gorbag targets. About another quarter are local government bodies, mainly city councils in front-line areas. Other targets include defense-sector entities and a body recorded publicly as a key transportation point for foreign military aid.

During 2025, the group distributed spearphishing e-mails containing macro-enabled Excel files themed as administrative fines or tax notices. ESET identified one spearphishing case on VirusTotal where operators sent messages from a compromised local government e-mail account in Ukraine belonging to the government of Ukraine’s Uzhhorod region, likely making the messages seem more credible. A machine-translated spearphishing e-mail asked recipients to review administrative fines from March 1, 2025, to March 31, 2025. ESET records indicate the first intrusion against a Ukrainian justice organization took place in late March 2025.

ESET suggested renewed attention to justice targets may stem from the February 2025 start of Ukraine’s war crimes trial against a captured Russian soldier. In early 2026, the group switched to RAR archives designed to exploit CVE-2025-8088, a WinRAR path traversal flaw. ESET Research disclosed CVE-2025-8088 in August 2025 after seeing RomCom, another Russia-aligned group, use it as a zero-day. The flaw is now patched.

When a system is vulnerable, the archive shows a decoy PDF, drops an LNK file into the Startup folder, and stores an encrypted payload and PowerShell loader in ProgramData. The LNK file launches the loader at every system start or restart, providing persistence. The first samples surfaced in December 2025 with a different chain, and the current version started in February 2026.

ESET followed BeautyStealer, a C++ stealer for browser data and files, from version 0.9 through 2.0. It collects browser cookies, saved login credentials, and local browser state from Chrome, Edge, Opera, and Firefox. Version 0.9 took only browser credentials, while version 1.1 added file-stealing.

Version 1.2 introduced XOR-based string encryption and moved exfiltration to a custom server. Version 2.0 added RC4 encryption and a self-delete mechanism that calls Windows API directly. Compressed harvested material goes to a Telegram chat controlled by the attacker or to a custom server running FastAPI. The stolen data reaches Telegram through the Telegram sendDocument API.

Once data is stolen, the malware removes itself from the host. Prior to BeautyStealer, Gorbag relied on Prime ReverseShell, a PowerShell reverse shell embedded in a .NET binary via PS2EXE. It ran commands on compromised systems and sent the output to a command-and-control server. The tool comes from the public PSSW100AVB repository on GitHub.

ESET has not observed Prime ReverseShell in the wild since BeautyStealer appeared. In April 2025, CERT-UA flagged UAC-0226 for using Prime ReverseShell.

The malware collects OpenVPN configuration files from user and system directories. A short VBA routine decoded a base64 payload in the spreadsheet cells, placed it in %ProgramData%, and executed it. In one instance, a macro-enabled Excel .XLSM file ran a VBA payload that decoded and launched BeautyStealer.

The stealer gathers files with certain extensions from Desktop, Documents, Downloads, removable media, and mapped network drives. Credential and private key extensions cover .kdbx for KeePass, .jks for Java KeyStore, .rdp for Remote Desktop, .pfx, and .zs2. Files bearing the .zs2 extension hold a secret electronic signature key from a Ukrainian accredited key certification center. BeautyStealer targets files matching roughly 40 extensions, and one sample contained an unusual extension, .bwetyutgvy, apparently left by developers to test exfiltration.

Damien Schaeffer of ESET said Gorbag might serve as an initial access broker, handing stolen credentials to other threat actors. ESET researcher Damien Schaeffer said the group’s targeting closely matches Russia’s intelligence priorities during the war. Schaeffer said Gorbag might be only the opening phase of a longer intrusion chain, with later phases still unobserved. “Rather than relying on sophisticated implants for long-term access, Gorbag uses a small toolset built for rapid collection,” Schaeffer said.

ESET said justice targeting may aim to monitor and disrupt the documentation and prosecution of war crimes by Russian forces. ESET assessed that targeting may also seek visibility into investigations identifying Russian assets and collaborators on Ukrainian soil. City councils may be targeted for battle damage assessment because they report confidential infrastructure damage and repair timelines after Russian air strikes. The campaign window shows that nearly every targeted city experienced Russian air strikes.

City councils handle local defense work, including recruitment and training centers and civil defense, suggesting another possible intelligence motive. This suggests the operators could provide Russian commanders with insight into how effective the strikes were. Defense-sector targets include an entity recorded publicly as a key transport point for foreign military aid that Russian air strikes struck.

In 2023, Ukraine’s SSSCIP reported that GRU- and FSB-linked threat actors attempted to compromise law enforcement bodies across the country. Ukraine’s judiciary has stayed active throughout the war, with several hundred indictments already issued.

Gorbag activity overlaps with a cluster Ukraine’s CERT-UA tracks as UAC-0226 and Trend Micro tracks as SHADOW-EARTH-066. CERT-UA attributes GIFTEDCROOK to UAC-0226, and BeautyStealer shares common roots with that infostealer. GIFTEDCROOK is a C/C++ stealer that takes cookies, browsing history, and authentication data from Chrome, Edge, and Firefox.

One variant includes a comment stating the file is not malicious and performs prime number generation from 1 to 900. ESET tested two AI assistants against that comment, and neither fell for it.

ESET said groups such as Gorbag will keep threatening Ukrainian state, justice, and defense bodies for as long as the war lasts. That warning stays valid while the war in Ukraine continues. “we expect groups such as Gorbag to remain a persistent threat,” ESET said.

ESET presented its Gorbag research at Virus Bulletin on October 14, 2026. Virus Bulletin published the white paper Gorbag: Orcs at the border, which contains the full technical analysis. ESET released Gorbag indicators of compromise and samples in a GitHub repository.