Threat Actor
Gorbag
- First Reported
- Nov 3, 2026
- Latest Reported
- Nov 3, 2026
Reported Context (2)
- Described as Russia-aligned and active since at least February 2025, Gorbag has been observed targeting Ukrainian organizations with information-stealing malware and spear-phishing. ESET said its targeting aligns with Russia's wartime intelligence priorities. ESET Reports Gorbag Campaigns Targeting Ukrainian Organizations With Data-Stealing Malware
- Eset tracks Gorbag as an infostealer operator that targeted Ukrainian organizations. The article describes it as Russia-aligned and says it may be acting as an initial access broker; that role and its broader purpose are presented as possibilities, not confirmed. ESET Details Gorbag Infostealer Campaign Targeting Ukrainian Organizations
CVE (1)
Malware (4)
People (1)
Threat Actors (2)
MITRE ATT&CK (11)
Products (11)
Tools (1)
Industries (3)
Countries (2)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.