A Russia-aligned espionage group has spent most of the past two years quietly stripping passwords, VPN settings and documents from Ukrainian police, courts, city councils and defense organizations, many of them close to the front line. ESET Research has named the group Gorbag and says it has been active since at least February 2025, attacking Ukrainian targets exclusively.
Parts of its toolkit have surfaced before. The GIFTEDCROOK infostealer, which Ukraine's CERT-UA attributes to a cluster it tracks as UAC-0226, belongs to the same activity, but ESET says Gorbag's targeting and overall operation had gone largely unexamined until now. The researchers first presented the findings at the Virus Bulletin conference on October 14, 2026.
City councils that count the bomb damage
According to ESET, about a quarter of Gorbag's victims are law enforcement and justice bodies, and another quarter are local administrations, mostly city councils in frontline areas. The rest are defense sector entities, plus an organization publicly documented as a major transportation hub for foreign military aid.
The council targeting looks odd until you consider what those offices hold. Ukrainian city councils often report damage from Russian air strikes, and while casualties are usually made public, assessments of damaged infrastructure and repair times generally are not. ESET notes that virtually every city whose council Gorbag targeted was hit by Russian strikes during the campaign window, which raises the possibility that the stolen data feeds Russian battle damage assessment. The researchers present this as one hypothesis alongside others, such as monitoring local recruitment and civil defense work.
The justice targeting fits an older pattern. ESET links it to Russia's interest in Ukrainian war crimes prosecutions and investigations into Russian assets and collaborators, and dates Gorbag's first attack on a Ukrainian justice entity to late March 2025.
Grab everything once, then vanish
Gorbag does not try to stay inside a network. Its spearphishing emails, themed around administrative fines or taxes and in one case sent from a compromised local government mailbox, delivered macro-laden Excel files throughout 2025. In early 2026 the group switched to booby-trapped RAR archives exploiting CVE-2025-8088, the WinRAR path traversal flaw ESET reported in August 2025 and first saw exploited as a zero-day by RomCom. It is the same bug other Russia-aligned crews have kept leaning on, as we reported in June. The archive shows a decoy PDF while planting a shortcut in the Windows Startup folder for persistence.
The main payload is BeautyStealer, a C++ stealer ESET tracked from version 0.9 to 2.0. It takes cookies and saved passwords from Chrome, Edge, Opera and Firefox, OpenVPN configurations, and documents from user folders, removable media and mapped network drives. It also hunts KeePass databases, RDP files, PFX certificates and .zs2 files, which store the secret electronic signature keys issued by Ukrainian accredited certification centers. Stolen data went to a Telegram chat in early versions and to a custom server from version 1.2 onward. Then the stealer deletes itself.
Before BeautyStealer, the group used a PowerShell reverse shell ESET calls Prime ReverseShell. One variant carried a comment addressed to AI assistants, claiming the script merely generated prime numbers. ESET tested two AI assistants against it, and neither was fooled.
That smash-and-grab style leads ESET to suggest Gorbag may act as an initial access broker, handing stolen credentials to other Russia-aligned groups. ESET frames this as a possibility, not an established finding.
Patch WinRAR and watch for these servers
Organizations in Ukraine should make sure WinRAR is updated past the CVE-2025-8088 fix, block macros in documents from outside the organization, and treat tax or fine notices from even familiar government senders with suspicion. Because BeautyStealer takes VPN profiles and signature keys, any confirmed infection warrants rotating those credentials, not just browser passwords. ESET published these network indicators, with the full set in its GitHub repository:
- 89[.]44[.]9[.]186 (Prime ReverseShell C&C, first seen 2025-03-28)
- 142[.]111[.]194[.]73 (BeautyStealer exfiltration server, first seen 2026-06-02)
Gorbag is a reminder that wartime espionage does not need elaborate malware. A simple stealer aimed at the right town hall can be worth more than a sophisticated implant sitting in the wrong network.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.