New Russia-Aligned Hacking Group Gorbag Targets Ukrainian Investigators, Local Councils and Aid Routes

A previously unidentified Russia-aligned hacking group, dubbed Gorbag, has been targeting Ukrainian government agencies, defence organisations and infrastructure used to move foreign military aid. According to a report published by security firm ESET, the group has been active since at least February 2025. It focuses on organisations near the front line and the Russian border, using relatively simple malware to steal sensitive documents, login credentials and other information.

Unlike more sophisticated espionage groups that try to stay inside networks for months, Gorbag appears to prioritise speed. Researchers said it steals information quickly and then removes traces of its malware. About a quarter of its known targets are Ukrainian law enforcement and judicial bodies, which may point to interest in war crimes investigations. Another quarter are local governments, mostly city councils near the front line, which hold non-public details on strike damage and repair times. Other targets include defence organisations and a major transport hub for foreign military assistance.

Gorbag mainly relies on phishing emails with malicious attachments, often disguised as official documents about administrative fines or taxes. While the targets are specific to the war in Ukraine, the method is common and familiar: a convincing email carrying an attachment that looks like routine paperwork. Any business that handles official-looking correspondence can be exposed to the same tactic.