New Russia-Aligned Spy Group Gorbag Steals Credentials and VPN Details From Ukrainian Targets

ESET researcher Damien Schaeffer has detailed a Russia-aligned espionage group the firm calls Gorbag. It has targeted Ukrainian organisations since at least February 2025, using a custom infostealer to harvest credentials, VPN configurations and documents. About a quarter of the targets were justice and law enforcement bodies, and another quarter were local administrations, mostly city councils near the front line. The rest included defence entities and an organisation publicly documented as a major transport hub for foreign military aid. ESET found targets only in Ukraine.

In 2025, the group sent phishing emails themed around administrative fines and taxes, one of them from a compromised local government account. These carried macro-enabled Excel files that installed the stealer. In early 2026, it switched to RAR archives exploiting CVE-2025-8088, a WinRAR flaw that ESET reported in August 2025. The archives showed a decoy PDF while quietly setting the malware to run at each system startup.

The stealer, called BeautyStealer, took cookies, saved passwords and browser data from Chrome, Edge, Opera and Firefox, along with OpenVPN configurations. It also gathered documents from user folders, removable media and network drives, including electronic signature key files. It then deleted itself after sending the data out. ESET said the toolset was built to collect data in a single pass rather than keep long-term access, and that the group may be passing credentials to other actors. It has not observed any later stages.