ESET Details Gorbag’s Cyberespionage Campaign Targeting Ukraine
Summary
ESET researchers detail Gorbag, a Russia-aligned actor targeting Ukrainian organizations with spearphishing and a WinRAR exploit. Its tools harvest browser credentials, VPN configurations, and files, then attempt to remove themselves.
Key points
- ESET reports Gorbag has targeted Ukrainian organizations since at least February 2025, including law enforcement, local administrations near the front line, and defense entities.
- In 2025, spearphishing attachments used macros to deliver BeautyStealer; from early 2026, weaponized RAR archives exploited CVE-2025-8088 to drop a Startup-folder LNK and a PowerShell loader.
- BeautyStealer collects browser cookies and passwords, VPN configurations, and selected files from local, removable, and mapped drives.
- Collected data is archived and exfiltrated through Telegram or, in later versions, a custom command-and-control server; BeautyStealer then removes itself.
- Gorbag previously used Prime ReverseShell, a PowerShell reverse shell, to execute commands and return output.
- ESET assesses that the focus on short-term harvesting may indicate Gorbag acts as an initial access broker, but says this remains a possibility.
Article Details
- Attack Vectors
- Spearphishing emails with official or governmental lures delivered malicious .xlsm attachments. If macros ran, embedded VBA decoded a base64 payload, dropped it into %ProgramData%, and executed BeautyStealer.
- From early 2026, weaponized RAR archives exploited CVE-2025-8088. The archive displayed a decoy PDF and dropped a LNK file into the Windows Startup folder, along with an encrypted payload and PowerShell loader in %ProgramData%.
- In one identified case, operators sent spearphishing emails from a compromised email account belonging to a local Ukrainian government.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 142[.]111[.]194[.]73 | BeautyStealer exfiltration server, first seen 2026-06-02. |
| IPV4 | 89[.]44[.]9[.]186 | Prime ReverseShell C&C server, first seen 2025-03-28. |
| SHA1 | 0589d2079fbef814dc7bb95c4b3b555c8b933af6 | SHA-1 of a malicious RAR archive associated with the PowerShell loader and LNK runner. |
| SHA1 | a5e0a82bf6cc302a20d917235643b748f73fcc27 | SHA-1 of a file identified as Prime ReverseShell. |
| SHA1 | c17369b4b49113d07f080df832e218156fb0940f | SHA-1 of a file identified as a spearphishing email sample. |
| SHA1 | e27e0d0a4b308f9b6b0469159931eb5e343e7ff8 | SHA-1 of an XLS lure document identified as a malicious dropper. |
MITRE ATT&CK
T1005 · Data from Local SystemBeautyStealer collected files from local user folders, removable media, and mapped network drives.T1027.009 · Embedded PayloadsThe lure spreadsheet contained a base64-encoded payload in its cells, which VBA decoded.T1059 · Command and Scripting InterpreterGorbag used a PowerShell reverse shell to execute commands and used a PowerShell loader in the later compromise chain.T1070.004 · File DeletionBeautyStealer removes itself after exfiltration.T1071.001 · Web ProtocolsThe article's ATT&CK table states that Prime ReverseShell used HTTPS to communicate with its C&C server.T1203 · Exploitation for Client ExecutionWeaponized RAR archives exploited CVE-2025-8088 to write files outside the user-selected directory.T1204.002 · Malicious FileVictims were lured into opening weaponized files and, with the spreadsheet chain, enabling macros.T1539 · Steal Web Session CookieBeautyStealer collected browser cookies.T1547.001 · Registry Run Keys / Startup FolderThe CVE-2025-8088 chain dropped a LNK file into the Windows Startup folder to trigger the loader on later startups.T1555.003 · Credentials from Web BrowsersBeautyStealer harvested stored passwords from Chrome, Edge, Opera, and Firefox.T1560 · Archive Collected DataGorbag compressed stolen data into an archive before exfiltration.T1566.001 · Spearphishing AttachmentGorbag delivered malicious attachments in targeted spearphishing emails.T1567 · Exfiltration Over Web ServiceBeautyStealer exfiltrated data to an attacker-controlled Telegram chat using the Telegram sendDocument API.T1583 · Acquire InfrastructureThe article says Gorbag acquired servers for Prime ReverseShell and BeautyStealer.T1586.002 · Email AccountsIn one case, Gorbag sent spearphishing emails from a compromised Ukrainian local-government email account.
CVE
Threat Actors
GorbagESET named this Russia-aligned threat actor and reports targeted attacks against Ukrainian organizations since at least February 2025, using spearphishing and malware for intelligence collection.RomComESET researchers first noticed CVE-2025-8088 being exploited as a zero day by RomCom, which the article describes as another Russia-aligned group involved in cybercrime and espionage.UAC-0226CERT-UA attributes GIFTEDCROOK, an infostealer mentioned in the article, to UAC-0226; the article does not attribute Gorbag's operations to this group.
Malware
BeautyStealerThe group’s toolset consists of a PowerShell reverse shell that we named Prime ReverseShell, and a C++ browser-data and file stealer that we named BeautyStealer.GIFTEDCROOKWhile elements of the group’s tooling – most notably the GIFTEDCROOK infostealer, which CERT-UA attributes to UAC-0226 – have previously appeared in public reporting, Gorbag’s targeting and overall activity havePrime ReverseShellThe group’s toolset consists of a PowerShell reverse shell that we named Prime ReverseShell, and a C++ browser-data and file stealer that we named BeautyStealer.
Products
Edgecookies, stored passwords, and local state from the Chrome, Edge, Opera, and Firefox browsers,Google Chromecookies, stored passwords, and local state from the Chrome, Edge, Opera, and Firefox browsers,Microsoft WindowsWhen opened on a vulnerable system, the archive displays a decoy PDF file while dropping a LNK file into the Windows Startup folder, along with an encrypted payload and a PowerShell loader in %ProgramData%.Mozilla Firefoxcookies, stored passwords, and local state from the Chrome, Edge, Opera, and Firefox browsers,OpenVPNOpenVPN configurations from both user and system directories, andOperacookies, stored passwords, and local state from the Chrome, Edge, Opera, and Firefox browsers,PowerShellThe group’s toolset consists of a PowerShell reverse shell that we named Prime ReverseShell, and a C++ browser-data and file stealer that we named BeautyStealer.TelegramStolen data is compressed into an archive and exfiltrated either to an attacker-controlled Telegram chat via the Telegram sendDocument API, or, from version 1.2 onward, to a custom C&C server that implements FastAPI.WinRARIn early 2026, Gorbag updated its compromise chain to abuse CVE-2025-8088, a WinRAR path traversal vulnerability discovered and reported by ESET Research.
Tools
PS2EXEbelow, Gorbag relied on Prime ReverseShell – a PowerShell reverse shell embedded in a .NET binary via the PS2EXE tool – to execute commands on compromised systems and return the output to its C&C server.PSSW100AVBPrime ReverseShell is derived from the publicly available PSSW100AVB repository on GitHub, with modifications to suit the operators’ needs.
Countries
RussiaESET researchers have been tracking a Russia-aligned threat actor that we named Gorbag.UkraineGorbag is a previously underreported, Russia-aligned threat actor; we have detected highly targeted attacks since February 2025, particularly against Ukrainian organizations near the Russia-Ukraine border.
Industries
Defensepreference for law enforcement and justice entities, local administrations near the front line, and the defense sector.Governmentthe operators sent spearphishing emails from a compromised email account belonging to a local government in Ukraine, likely giving the message (shown in Figure 1) additional credibility.Law enforcement and justice2025, the group has focused exclusively on Ukrainian targets, with a clear preference for law enforcement and justice entities, local administrations near the front line, and the defense sector.