ESET Reports Gorbag Campaigns Targeting Ukrainian Organizations With Data-Stealing Malware
Summary
ESET reports Russia-aligned Gorbag has targeted Ukrainian organizations since at least February 2025 using infostealers and reverse shells. Trend Micro linked the actor to attacks exploiting patched WinRAR vulnerability CVE-2025-8088.
Key points
- ESET says Gorbag has focused on Ukrainian organizations since at least February 2025, particularly law enforcement, local administrations near the front line, and the defense sector.
- The activity overlaps with clusters tracked by CERT-UA as UAC-0226 and Trend Micro as SHADOW-EARTH-066.
- GIFTEDCROOK can steal browser cookies, browsing history, and authentication data; Trend Micro attributed its delivery to attacks exploiting patched WinRAR vulnerability CVE-2025-8088.
- Spear-phishing emails use official- or government-themed lures and malicious attachments; one described chain uses an Excel macro to run a VBA payload that executes BeautyStealer.
- BeautyStealer collects browser data, VPN configurations, and selected files, sends compressed data to a Telegram chat or custom C2 server, and removes itself after completing its task.
- Early 2025 activity included Prime ReverseShell, which can execute commands on compromised systems and return results to a C2 server.
- ESET tested two AI assistants against prompt-injection text embedded in a reverse-shell script; both still identified it as malicious.
Article Details
- Event Type
- Targeted cyber-espionage and information-stealing activity attributed to the Russia-aligned threat actor Gorbag.
- Impact
- Attacks targeting Ukrainian organizations have used spear-phishing attachments to deliver malware that steals browser data, VPN configurations, and selected files, including documents and KeePass databases. Some activity used a WinRAR vulnerability to execute GIFTEDCROOK. Stolen data was sent to an attacker-controlled Telegram chat or a custom C2 server. ESET said the activity may represent an initial-access operation, but any handoff to other threat actors remains a possibility rather than a confirmed outcome.
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelCollected data was sent to a custom command-and-control server.T1059.005 · Visual BasicA VBA payload in a macro-enabled Excel spreadsheet was used to decode and execute BeautyStealer.T1566.001 · Spearphishing AttachmentSpear-phishing emails with malicious attachments were used to initiate malware delivery.T1574.002 · DLL Side-LoadingA DLL sideloading chain was used to execute GIFTEDCROOK after exploitation of the WinRAR vulnerability.
CVE
People
Threat Actors
GorbagDescribed as Russia-aligned and active since at least February 2025, Gorbag has been observed targeting Ukrainian organizations with information-stealing malware and spear-phishing. ESET said its targeting aligns with Russia's wartime intelligence priorities.SHADOW-EARTH-066Trend Micro tracks a cluster whose activity overlaps with Gorbag. The article describes overlapping activity, not a confirmed alias relationship.UAC-0226CERT-UA tracks a cluster whose activity overlaps with Gorbag; CERT-UA flagged its use of Prime ReverseShell in April 2025. The article describes overlapping activity, not a confirmed alias relationship.
Malware
BeautyStealerExcel spreadsheet (.XLSM) is used as a conduit to run a VBA payload, which then decodes and executes BeautyStealer.GIFTEDCROOKA key tool in the threat actor's malware arsenal is GIFTEDCROOK, a C/C++ stealer that facilitates the theft of sensitive data from web browsers like Google Chrome, Microsoft Edge, and Mozilla Firefox, such as cookies,Prime ReverseShellInitial attack waves observed in early 2025 have utilized Prime ReverseShell, a derivative of PSSW100AVB that functions as a reverse shell to execute commands on compromised systems and return the results back to a C2PSSW100AVBInitial attack waves observed in early 2025 have utilized Prime ReverseShell, a derivative of PSSW100AVB that functions as a reverse shell to execute commands on compromised systems and return the results back to a C2
Products
Google Chromeis GIFTEDCROOK, a C/C++ stealer that facilitates the theft of sensitive data from web browsers like Google Chrome, Microsoft Edge, and Mozilla Firefox, such as cookies, browsing history, and authentication data.KeePassand files matching specific extensions, including Microsoft Office documents, archives, emails, KeePass databases, remote desktop protocol (RDP) configurations, and VPN configurations.Microsoft Edgea C/C++ stealer that facilitates the theft of sensitive data from web browsers like Google Chrome, Microsoft Edge, and Mozilla Firefox, such as cookies, browsing history, and authentication data.Mozilla Firefoxfacilitates the theft of sensitive data from web browsers like Google Chrome, Microsoft Edge, and Mozilla Firefox, such as cookies, browsing history, and authentication data.OpenVPNis the primary data-harvesting tool that can capture data from Chrome, Edge, Opera, and Firefox, OpenVPN configurations, and files matching specific extensions, including Microsoft Office documents, archives,OperaBeautyStealer is the primary data-harvesting tool that can capture data from Chrome, Edge, Opera, and Firefox, OpenVPN configurations, and files matching specific extensions, including Microsoft Office documents,WinRAREarlier this June, Trend Micro also attributed the adversary to attacks weaponizing a now-patched vulnerability in WinRAR (CVE-2025-8088) to trigger a DLL sideloading chain responsible for executing GIFTEDCROOK.
Countries
RussiaA Russia-aligned threat actor known as Gorbag has been observed using simple information stealer malware in attacks targeting Ukrainian organizations.UkraineThe activity shares overlaps with a cluster tracked by the Computer Emergency Response Team of Ukraine (CERT-UA) under the moniker UAC-0226 and by Trend Micro as SHADOW-EARTH-066. Gorbag is known to be active since at
Industries
Defensepreference for law enforcement and justice entities, local administrations near the front line, and the defense sector," ESET researcher Damien Schaeffer said in a report shared with The Hacker News.Governmentmounted by the threat actor employ spear-phishing emails with malicious attachments using official- or government-themed lures, such as administrative fines or taxes, to initiate malware delivery. In one case, aLaw enforcementFebruary 2025, the group has focused exclusively on Ukrainian targets, with a clear preference for law enforcement and justice entities, local administrations near the front line, and the defense sector," ESET