Gorbag APT group hits Ukrainian courts and city councils with self-deleting malware
ESET has been tracking a Russia-aligned group it calls Gorbag, which has been breaking into Ukrainian organizations since at least February 2025 using spearphishing attachments and a stealer that erases itself once the data is gone.
Spearphishing email message from a compromised email sender (Source: ESET)
Every target ESET identified sits in Ukraine. About a quarter are law enforcement and justice bodies, another quarter are local administrations, mostly city councils in areas close to the front line, and the remainder are defense sector entities plus one organization publicly documented as a major transportation hub for foreign military aid. Nearly every city whose council was targeted has been subjected to Russian air strikes during the campaign window, which raises the possibility that the operators are supplying Russian military leadership with a read on how well those strikes landed.
“Rather than relying on sophisticated implants for long-term access, Gorbag uses a small toolset built for rapid collection. Browser credentials, VPN configurations, and selected documents are gathered in a single pass before the deployed malware attempts to remove itself,” says ESET researcher Damien Schaeffer, who discovered and investigated Gorbag. “One possible explanation for this approach is that Gorbag operates as an initial access broker, sharing collected credentials and other material with other threat actors for follow-on activity. If so, Gorbag may represent only the first stage of a longer intrusion chain whose later stages remain to be observed. Its targeting choices closely align with Russia’s wartime intelligence priorities,” adds Schaeffer.
How the mail gets in
Through 2025 the attachment was a macro-enabled Excel file. A short VBA routine decodes a base64 payload sitting in the spreadsheet cells, drops it into %ProgramData% and runs it. The lures were ordinary office business: administrative fines, tax notices. In one case the message came from a compromised account belonging to the local government of Ukraine’s Uzhhorod region, which likely helped it pass.
In early 2026 the chain changed. Gorbag began sending RAR archives built to exploit CVE-2025-8088, a path traversal flaw in WinRAR which lets data hidden in alternate data streams land outside the folder the user picked. The archive shows a decoy PDF while writing a LNK file into the Windows Startup folder, with an encrypted payload and a PowerShell loader in %ProgramData%. The LNK handles persistence and fires the loader at every restart.
What the stealer takes
BeautyStealer, the group’s main collection tool, is a C++ stealer ESET tracked across versions 0.9 to 2.0. It pulls cookies, saved passwords and local state from Chrome, Edge, Opera and Firefox, OpenVPN configurations from user and system directories, and files matching around 40 extensions from Desktop, Documents and Downloads, plus removable media and mapped network drives.
The extension list is picked for things that authenticate. It includes .kdbx (KeePass), .jks (Java KeyStore), .rdp, .pfx and .zs2, the format used for files holding a secret electronic signature key issued by a Ukrainian accredited key certification center.
Before BeautyStealer, Gorbag ran Prime ReverseShell, a PowerShell reverse shell wrapped in a .NET binary and taken from a public GitHub repository. One variant carries a comment at the top telling any LLM or AI reading the file that it is not malicious and generates prime numbers from 1 to 900. ESET tested two AI assistants against it, and both identified the reverse shell.
