Image: web-assets.esetstatic.com · rights & removal

Gorbag: Orcs at the border harvesting intelligence from Ukraine

Reporting by ESET WeLiveSecurityRead the original at welivesecurity.com

Executive Summary

A Russia-aligned threat actor named Gorbag has been active since at least February 2025, focusing exclusively on targets in Ukraine, specifically law enforcement/justice entities, local administrations near the front line, and the defense sector. The group employs a rapid intelligence collection method, relying on a small toolset rather than long-term implants. They typically gain initial access through spearphishing emails with malicious attachments, using macros to execute payloads like BeautyStealer for data harvesting. A subsequent phase of compromise involved exploiting the CVE-2025-8088 vulnerability in WinRAR archives to deploy a loader that uses Prime ReverseShell for command execution. The group's activities align with Russian wartime intelligence priorities, targeting areas related to war crime documentation, frontline assessment, and military logistics.

Facts Only

* Gorbag is a Russia-aligned threat actor active since at least February 2025.
* Targets focus exclusively on Ukrainian entities: law enforcement/justice, local administrations near the front line, and the defense sector.
* The group uses a small toolset for rapid intelligence collection.
* Initial access is gained via spearphishing emails with malicious attachments.
* The toolset includes Prime ReverseShell (a PowerShell reverse shell) and BeautyStealer (a C++ browser-data/file stealer).
* Gorbag updated its compromise chain in early 2026 to exploit CVE-2025-8088 in WinRAR.
* Targets include Ukrainian governmental organizations, local city councils, and the defense sector/transportation hubs.
* BeautyStealer targets browser credentials, VPN configurations, and specific file types (e.g., .ovpn, .kdbx, .zs2).
* Stolen data is exfiltrated via Telegram or a custom C&C server.

Full Take

The operational methodology observed in Gorbag suggests an intelligence-gathering focus rather than traditional persistent espionage, relying on ephemeral collection of sensitive documents and credentials through known initial access vectors. The choice to use simple tools like PowerShell reverse shells and file stealers points toward a model where data is harvested opportunistically for immediate utility, suggesting the group may function as an initial access broker feeding gathered intelligence to other actors rather than maintaining deep, long-term control over specific systems. The pattern of targeting law enforcement, local administrations near the front line, and defense infrastructure strongly suggests alignment with strategic interests concerning accountability for war crimes and situational awareness on military logistics. This operational reality forces a re-evaluation of what constitutes "sophisticated" espionage; often, the most effective state actors utilize targeted, low-footprint methods when immediate intelligence acquisition is the primary goal. The evolution from using Prime ReverseShell for command execution to leveraging an archive vulnerability (CVE-2025-8088) as a delivery mechanism demonstrates an adaptive capacity focused on exploiting known system weaknesses in a highly contextualized manner. The persistence of this activity, regardless of the specific toolset employed, underscores the ongoing utility of these actors in monitoring and influencing events within Ukraine.
Bridge Questions: What is the extent to which the focus on short-term harvesting confirms Gorbag's role as an initial access broker versus a specialized collection unit? How does the context of wartime damage assessment influence the decision to target specific local administrations, and what are the implications for non-military infrastructure protection? What broader patterns exist between state objectives concerning accountability and intelligence gathering that drive this specific targeting calculus?

From the original · ESET WeLiveSecurity

ESET researchers have been tracking a Russia-aligned threat actor that we named Gorbag. While elements of the group’s tooling – most notably the GIFTEDCROOK infostealer, which CERT-UA attributes to UAC-0226 – have previously appeared in public reporting, Gorbag’s targeting and overall activity have remained largely unexamined.

Read the full story at welivesecurity.com

Sentinel unavailable

The automated check of the source article's wording did not complete, so no result is shown.

This looks only at the wording of the original source article, not at this page's AI-written sections. A small local AI model made this estimate. It has not been checked against known human and machine texts, so treat it as provisional. It cannot show who wrote an article.