A Russia-aligned threat actor known as Gorbag has been targeting Ukrainian organizations with information-stealing malware since at least February 2025. The group’s main targets include law enforcement agencies, justice institutions, local administrations near the front line, and organizations in the defense sector.
The group's activities overlap with campaigns tracked by Ukraine's Computer Emergency Response Team (CERT-UA) as UAC-0226 and by Trend Micro as SHADOW-EARTH-066.
One of Gorbag's main tools is GIFTEDCROOK, a C/C++ information stealer designed to collect sensitive data from browsers such as Google Chrome, Microsoft Edge, and Mozilla Firefox. It can steal cookies, browsing history, and authentication information.
ESET says that Gorbag uses a small toolkit for intelligence gathering such as browser credentials, VPN configurations, and selected documents, possibly acting as an initial access broker that then shares the access and gathered information with other threat actors for follow-up activity.
“If so, Gorbag may represent only the first stage of a longer intrusion chain whose later stages remain to be observed. Its targeting choices closely align with Russia’s wartime intelligence priorities,” the researchers say.
The group has also deployed another info-stealing tool called BeautyStealer through spear-phishing emails containing malicious attachments disguised as official government documents, including notices about taxes and administrative fines. One observed infection method involved an Excel file (.XLSM) containing malicious VBA macros that decoded and executed the malware.
BeautyStealer can collect browser data from Chrome, Edge, Opera, and Firefox, as well as OpenVPN configurations, Microsoft Office files, email data, archives, KeePass databases, and Remote Desktop Protocol (RDP) configurations.
After collecting the information, the malware compresses the files into an archive and sends them to an attacker-controlled Telegram chat or a command-and-control (C&C) server built with FastAPI. It then removes itself from the infected system, suggesting that its main purpose is short-term data collection rather than maintaining long-term access.
The group’s previous campaigns also used Prime ReverseShell, a tool derived from PSSW100AVB. It provides attackers with remote command execution, allowing them to run commands on compromised systems and send the results back to a C&C server.
In early 2026, Gorbag updated its compromise chain to exploit a WinRAR path traversal vulnerability (CVE-2025-8088) that allows specially crafted data stored in alternate data streams to be extracted outside the user-selected directory.
“Cyberespionage operations do not always require sophisticated malware. In the case of Gorbag, simple infostealers and a reverse shell are enough to support targeted intelligence collection against Ukrainian organizations of clear wartime interest to Russia,” ESET noted in its report.