ESET names Gorbag, a Russia-aligned group harvesting intelligence from Ukraine

ESET researchers named a Russia-aligned threat actor Gorbag and have tracked it since at least February 2025 as it targeted Ukrainian organizations.

The group targets only Ukrainian organizations, prioritizing police and judicial bodies, municipal administrations near the front line, and military-industrial targets. Military-industrial targets are organizations that produce weapons or defense equipment. Every identified target is in Ukraine. ESET has observed no targeting outside the country’s borders.

Ukrainian governmental organizations in law enforcement and justice make up about a quarter of identified targets. Another quarter are local governmental entities, mainly city councils near the front line. Current targets also include military-sector organizations and one body described publicly as a major transit point for foreign military aid.

The group delivers malware via spearphishing e-mails that contain malicious attachments. Spearphishing is a targeted form of e-mail fraud aimed at specific individuals or organizations, and malicious attachments are files designed to install harmful code when opened. During 2025, the group relied on macro-enabled Excel files themed around administrative fines or taxes. In one case, spearphishing e-mails originated from a compromised local government e-mail account in Ukraine to add credibility to the messages.

If macros run, a VBA routine decodes a base64 payload concealed in spreadsheet cells, writes it to %ProgramData%, and launches BeautyStealer. Macros are small programs embedded in spreadsheet files, and VBA is a programming language used to write them. Base64 is an encoding scheme that represents binary data in text form. %ProgramData% is a hidden Windows folder used to store application data.

The archive displays a decoy PDF and deposits an LNK file in the Windows Startup folder. An encrypted payload and a PowerShell loader are copied to %ProgramData% so they survive restarts. PowerShell is a task automation and configuration management framework from Microsoft. The LNK file starts the loader whenever the system boots or restarts.

Earlier, the group relied on Prime ReverseShell, a PowerShell reverse shell packaged inside a .NET binary using PS2EXE. Prime ReverseShell comes from the public PSSW100AVB repository on GitHub, altered by the operators. ESET has not observed Prime ReverseShell in use since the group developed BeautyStealer. “We have not observed Prime ReverseShell in use since the group developed BeautyStealer, its custom infostealer,” ESET researchers said.

One variant included a comment falsely saying the file generates prime numbers to trick AI assistants and security products. ESET tested two AI assistants with the comment, and the comment fooled neither assistant.

BeautyStealer is a C++ tool that pulls browser data and files, and ESET has tracked it from version 0.9 to version 2.0. C++ is a programming language used to build software applications. Between versions 0.9 and 2.0, BeautyStealer added file theft, XOR-encrypted strings, custom server exfiltration, RC4 encryption, and self-deletion through the Windows API. XOR string encryption obscures text using a logical operation, and RC4 is a stream cipher used to encrypt data.

BeautyStealer collects cookies, saved passwords, and local application state from Chrome, Edge, Opera, and Firefox, and it also collects OpenVPN configuration files held in both user and system folders. Cookies are small files that websites store on a user’s device to remember login sessions. Saved passwords are credentials stored by a browser for automatic sign-in. “Browser credentials, VPN configurations, and selected documents are gathered in a single pass before the deployed malware attempts to remove itself,” Damien Schaeffer said.

It steals Office documents, archives, e-mails, and VPN configurations from the Desktop, Documents, Downloads folders, removable media, and mapped network drives. Removable media includes USB drives and similar storage devices. Mapped network drives are shared folders accessed over a network. It targets extensions for OpenVPN, KeePass, Java KeyStore, Remote Desktop, Personal Information Exchange, and .zs2 files that hold Ukrainian electronic signature keys.

The stolen data is compressed into an archive and transmitted through an attacker-controlled Telegram chat using the Telegram sendDocument API. Telegram is a messaging platform with an application programming interface that allows automated file transfers. Compressed archives reduce file size for faster transfer.

Starting with version 1.2, BeautyStealer also sends data to a custom command-and-control server built with FastAPI. FastAPI is a web framework for building APIs with Python. A C&C server is a command-and-control system that receives data from infected machines. BeautyStealer deletes itself after exfiltration, which points to short-term data gathering instead of sustained access.

One sample used an unusual extension, .bwetyutgvy, that matches no known file type and was probably left by developers to test exfiltration. File extensions are the suffixes at the end of file names that show their format.

ESET Research disclosed CVE-2025-8088 in August 2025 and first observed it exploited as a zero-day by RomCom, another Russia-aligned group. CVE-2025-8088 is a path traversal vulnerability in WinRAR. WinRAR is a file archiving utility for Windows. A zero-day is a vulnerability that is exploited before a vendor patch is available.

In early 2026, the group started using weaponized RAR archives that exploit this flaw. RAR archives are compressed file containers. Weaponized archives are malicious files designed to compromise systems when opened.

ESET believes Gorbag may serve as an initial access provider for other actors, passing along credentials it collects while later compromise stages stay hidden. An initial access provider is a group that gains entry to a network and then shares or sells that access to others. Credentials are usernames, passwords, or tokens used to access systems. “Rather than relying on sophisticated implants for long-term access, Gorbag uses a small toolset built for rapid collection,” said Damien Schaeffer.

The group’s targeting matches Russian wartime intelligence priorities, such as tracking war-crimes prosecutions, assessing battle damage from air strikes, and monitoring incoming military supplies. Almost every targeted municipal district faced Russian aerial bombardment while the operation was active. Air strikes are attacks carried out by aircraft against ground targets.

ESET says operators might give Russian military leadership insight into how effective strikes were, based on this targeting. ESET suggests battle damage assessment and observation of local defense efforts, including recruitment and training centers, explain why city councils are targeted. City councils manage local defense work, including recruitment and training centers and civil defense organization. Recruitment and training centers prepare personnel for military or civil defense service, and battle damage assessment refers to evaluating the results of military strikes.

Ukraine’s courts have issued several hundred war-crime indictments, and a trial against a captured Russian soldier began in February 2025. ESET says the trial’s opening in February 2025 may explain renewed attention to justice-sector targets. The group’s first move against a Ukrainian justice body took place in late March 2025, ESET data shows. In 2023, Ukraine’s SSSCIP said actors linked to the GRU and FSB attempted to compromise law enforcement bodies nationwide.

ESET says espionage campaigns can work without advanced malware. An infostealer is malware designed to gather information from infected systems rather than maintain persistent access. ESET assesses that infostealers plus a reverse shell can support targeted intelligence collection against Ukrainian organizations that matter to Russia’s war effort. “As long as the war in Ukraine continues, we expect groups such as Gorbag to remain a persistent threat,” ESET said.

ESET published the research on WeLiveSecurity on November 3, 2026. On Oct. 14, 2026, ESET presented its Gorbag findings at the Virus Bulletin conference and released a white paper with the technical analysis. ESET researcher Damien Schaeffer found and investigated Gorbag.

ESET posted indicators of compromise and samples to a GitHub repository. Indicators of compromise are forensic artifacts that help defenders identify intrusions. The MITRE ATT&CK technique table is built on framework version 20.

CERT-UA links the related GIFTEDCROOK infostealer to UAC-0226. DEV Community says this does not prove Gorbag and UAC-0226 are the same actor. An alias is a different name for the same threat actor. Linking the related tool does not show that both names point to one group.