A threat actor known as Gorbag has targeted Ukrainian organizations with phishing attacks and malware designed to steal sensitive data, according to ESET researcher Damien Schaeffer. The group has been active since at least February 2025, with a focus on law enforcement and justice bodies, local administrations near the front line, and the defense sector.

Gorbag’s activity overlaps with operations tracked by Ukraine’s Computer Emergency Response Team as UAC-0226 and by Trend Micro as SHADOW-EARTH-066. Trend Micro previously linked the group to attacks exploiting the now-patched WinRAR vulnerability CVE-2025-8088. The flaw was used to launch a DLL sideloading chain that executed the GIFTEDCROOK information stealer.

GIFTEDCROOK can collect browser data, including cookies, browsing history and authentication information from Chrome, Edge and Firefox. Gorbag’s malware is also designed to gather VPN configurations and selected documents, which could allow the group to pass stolen information to other threat actors, ESET said. The researchers noted that this potential role as an initial access broker has not been confirmed.

The attacks typically begin with spear-phishing emails carrying malicious attachments and government-themed lures, such as notices about fines or taxes. In one documented method, a macro-enabled Excel file runs a VBA payload that decodes and launches BeautyStealer.

BeautyStealer can harvest information from Chrome, Edge, Opera and Firefox, as well as OpenVPN configurations and files such as Office documents, archives, emails, KeePass databases and remote desktop settings. It compresses the collected data and sends it to an attacker-controlled Telegram chat or a custom command-and-control server. After completing its collection, the malware removes itself from the compromised device.

Early 2025 attack waves also used Prime ReverseShell, a tool derived from PSSW100AVB that executes commands on compromised systems and returns the results to a command-and-control server. CERT-UA reported UAC-0226’s use of the tool in April 2025. One version included a comment aimed at AI systems, falsely claiming the script was harmless; testing cited by ESET found that two AI assistants still identified it as a reverse shell.

ESET said Gorbag’s operations show that targeted intelligence collection does not necessarily require sophisticated malware: simple information stealers and a reverse shell can support attacks on Ukrainian organizations considered of wartime interest to Russia.

Sources: The Hacker News.