Gorbag APT Targets Ukrainian Courts and Councils with Self-Deleting Malware
Russia-aligned Gorbag APT group has been targeting Ukrainian organizations since February 2025 with spearphishing emails delivering self-deleting stealer malware.
The Russia-aligned threat actor tracked as Gorbag has been actively compromising Ukrainian organizations since at least February 2025, employing a sophisticated spearphishing campaign that delivers a self-deleting stealer malware. ESET, which has been monitoring the group's activities, notes that nearly every identified target is located within Ukraine, with a significant concentration in areas close to the front lines.
Targets include a quarter of law enforcement and justice bodies, another quarter of local administrations such as city councils, and the remainder are defense sector entities. One notable target is a major transportation hub for foreign military aid. Given the proximity of many targeted cities to active combat zones, researchers speculate that Gorbag may be providing intelligence to Russian military leadership regarding the effectiveness of air strikes.
ESET researcher Damien Schaeffer explained that Gorbag's operational strategy focuses on rapid data collection rather than establishing long-term persistence. The malware gathers browser credentials, VPN configurations, and selected documents in a single pass before attempting to erase itself. This approach suggests Gorbag might function as an initial access broker, providing stolen information to other threat actors for subsequent malicious activities, aligning closely with Russia's wartime intelligence priorities.
Initially, through 2025, Gorbag utilized macro-enabled Excel files delivered via spearphishing emails. A short VBA routine within these files would decode a base64 payload from spreadsheet cells, save it to the %ProgramData% directory, and execute it. The lures used were common office-related themes like administrative fines or tax notices. The use of compromised email accounts, such as one belonging to the local government of Ukraine’s Uzhhorod region, likely aided in bypassing initial defenses.
In early 2026, the attack chain evolved. Gorbag began distributing RAR archives designed to exploit CVE-2025-8088, a path traversal vulnerability in WinRAR. This flaw allows attackers to write data hidden in alternate data streams outside the intended archive folder. The archive would present a decoy PDF to the user while secretly writing a LNK file into the Windows Startup folder, alongside an encrypted payload and a PowerShell loader in %ProgramData%. This LNK file ensures persistence by launching the loader upon every system restart.
The primary data collection tool employed by Gorbag is known as BeautyStealer, a C++ based stealer observed in versions 0.9 through 2.0. It is designed to exfiltrate browser credentials, including cookies and saved passwords, from popular browsers like Chrome, Edge, Opera, and Firefox. Additionally, it collects OpenVPN configurations from both user and system directories. The malware also searches for and steals files matching approximately 40 specific extensions from various locations, including Desktop, Documents, Downloads, and even removable media and mapped network drives.
The targeted file extensions are chosen for their potential to contain authentication information or sensitive data. This includes formats like .kdbx (KeePass), .jks (Java KeyStore), .rdp, .pfx, and .zs2. The .zs2 format is particularly noteworthy as it is used for files containing secret electronic signature keys issued by Ukrainian accredited key certification centers, highlighting the group's focus on obtaining credentials and sensitive national data.
Prior to deploying BeautyStealer, Gorbag has been observed using Prime ReverseShell, a PowerShell reverse shell encapsulated within a .NET binary. This tool is reportedly sourced from a public GitHub repository. Interestingly, one variant of Prime ReverseShell contained a comment explicitly stating it was not malicious and generated prime numbers, seemingly an attempt to mislead AI-based security analysis. However, ESET confirmed that two AI assistants were still able to correctly identify the reverse shell functionality.
The Gorbag campaign has evolved its attack vector, shifting from macro-enabled spreadsheets to exploiting the WinRAR path traversal vulnerability, CVE-2025-8088, in early 2026. This change allows for the delivery of a more sophisticated payload, BeautyStealer, which is capable of harvesting credentials from multiple browsers and exfiltrating various document types.
This new reporting details Gorbag's use of a specific WinRAR vulnerability (CVE-2025-8088) for DLL sideloading to deploy the GIFTEDCROOK information stealer. Additionally, the article highlights the group's use of BeautyStealer and PrimeReverseShell, with one variant attempting to deceive AI analysis tools by falsely claiming to perform prime number generation.