Gorbag Targets Ukraine With Data-Stealing Phishing Campaigns

Last updated: November 3, 2026

ESET has observed the Russia-aligned threat group Gorbag compromising Ukrainian organizations since at least February 2025. Its operation uses targeted email lures to deploy malware that harvests authentication material and selected documents, then attempts to erase itself. The identified victims include judicial institutions, municipal authorities, defense-sector groups and a transport facility associated with foreign military assistance.

Spearphishing evolves from Excel to WinRAR exploitation

During 2025, Gorbag distributed macro-enabled Excel workbooks through messages built around familiar government business, such as tax demands and administrative penalties. A compact VBA routine decoded a Base64 payload embedded in spreadsheet cells, placed it under ProgramData and launched it.

ESET also found a lure sent from a hijacked mailbox connected to the Uzhhorod regional government. That genuine sender history probably increased the message’s credibility, showing how compromised accounts can bypass controls built solely around suspicious domains or forged identities.

The operation shifted in early 2026. New messages carried RAR files constructed to abuse CVE-2025-8088, a WinRAR path-traversal weakness that permits content concealed in alternate data streams to escape the extraction directory. While the victim sees a PDF, the archive also installs an LNK shortcut in the Windows Startup folder. The shortcut launches a PowerShell loader from ProgramData whenever Windows starts again.

This evolution demonstrates how the group can preserve its collection goals while changing how it reaches victims. Organizations trained to look only for Office macros would therefore miss the newer archive-based route.

Authentication data drives the collection strategy

BeautyStealer is a C++-written credential and document stealer that ESET encountered in versions 0.9 through 2.0. It extracts cookies, stored passwords and browser state from Chrome, Edge, Opera and Firefox. It also searches user and system locations for OpenVPN connection profiles.

Documents are selected by extension across Desktop, Documents, Downloads, removable media and mapped network drives. ESET identified roughly 40 eligible extensions, including KeePass databases, Java KeyStores, remote desktop configurations, PFX certificates and .zs2 files containing secret electronic-signature keys from an accredited Ukrainian certification authority.

Those choices indicate an interest in material that could enable continued access. A password database, VPN profile, certificate or signed document can be more useful for follow-on activity than an ordinary text file. Even when the stealer disappears, the copied material may retain its value.

Before adopting BeautyStealer, Gorbag relied on Prime ReverseShell. ESET describes it as a remote-access shell built with PowerShell and packaged inside a .NET executable originating from a public GitHub project. A version included text intended to deceive AI systems into believing the code merely generated prime numbers. Two AI assistants tested by ESET nevertheless recognized the shell.

The result offers a useful caution: deceptive comments may influence one review process while failing to change another. Security teams should still examine executable behavior instead of treating an embedded description as evidence that a file is safe.

Why Ukraine’s institutions are significant targets

Every victim identified in ESET’s research was located in Ukraine. Law-enforcement and judicial institutions accounted for approximately one-quarter of the targets, while municipal bodies represented another quarter. Most of the affected municipal organizations were councils situated near the front line. Other victims belonged to defense industries or worked at a transport facility publicly associated with moving foreign military assistance.

Nearly all communities targeted through their councils endured Russian air raids during the period examined by ESET. That pattern raises the possibility that intercepted material could help Russian military leaders judge the effectiveness of strikes. ESET treated this as a plausible interpretation, not an established fact.

The institutional mix nevertheless points toward wartime intelligence collection. Judicial offices may hold sensitive cases, councils oversee communities and public services near the fighting, and defense organizations can be connected to military activity and supply networks. Gorbag’s behavior appears designed to gather useful information quickly from these exposed institutions.

Why it matters: deletion does not equal containment

Rather than establishing sophisticated implants for enduring access, Gorbag has emphasized a compact collection process. ESET researcher Damien Schaeffer said the group may function as an access broker, providing captured credentials and information to other threat actors for subsequent operations. If that theory is correct, Gorbag supplies only the opening phase of an intrusion whose remaining phases have not yet been identified.

This possibility widens the incident-response challenge. Investigators may discover email, endpoint and network records after the payload has erased itself. That absence of active malware should not be interpreted as proof that the system is safe. Passwords, browser sessions, certificates, VPN profiles and documents may already have left the device.

Defenders face a balance between disruption and coverage. Rejecting all ordinary office attachments would hinder daily work without addressing hijacked legitimate mailboxes. Updating WinRAR can close the cited archive-exploitation route, but it does not replace user reporting, email inspection or credential containment.

The appropriate response is to view every exposed identity and document as potentially compromised. Erasing the executable addresses current malware activity; it does not recover copied information or prevent another operator from using it.

What to watch next

Several signals could indicate whether Gorbag represents a sustained access service or merely one phase of a broader campaign. Important developments include further targeting of courts and local government, increased use of Prime ReverseShell, and evidence that captured information reaches separate criminal or military operators. Continued movement toward exploit-based delivery would also show how readily the group revises its intrusion methods.

Decision checklist

When reviewing a possible Gorbag compromise, determine:

• Did the lure come from a genuine but compromised organizational mailbox?
• Was a macro-enabled workbook or exploit-bearing RAR archive opened?
• Do ProgramData or the Windows Startup folder contain suspicious artifacts?
• Could browser, VPN or certificate-based authentication material have been accessed?
• Which credentials, sessions and digital keys should be revoked or rotated?
• Do email, endpoint and network records reveal what executed and what data was exposed?

Key takeaways

• Removing malware does not reverse the theft of credentials, sessions, certificates and documents.
• Defenses must cover malicious archives, Startup-folder persistence and messages originating from hijacked legitimate accounts.
• Possible downstream use of Gorbag’s collected information makes containment broader than malware removal.