ESET has tracked a group it calls Gorbag since at least February 2025, whose toolkit suits one fast pass rather than a long stay. All victims sit in Ukraine, and policing and judicial agencies make up roughly one in four, municipal government, mostly councils in frontline districts, takes another such share. Defense companies account for most of the rest, including one entity publicly documented as a major hub for foreign military aid. Nearly every city with a targeted council has since absorbed Russian air strikes.
Office lures, then a RAR file
Through 2025 the entry point was a macro-enabled spreadsheet whose VBA decoded a base64 blob from its cells, dropped it into %ProgramData% and ran it, using fines and tax notices as bait. At least one lure used a hijacked mailbox inside the Uzhhorod regional administration.
Early this year the chain shifted to RAR archives built to abuse CVE-2025-8088, the WinRAR path traversal that parks data outside the folder a user selects. The victim sees a PDF preview; the archive leaves a Startup entry that reruns encrypted payloads after each reboot.
BeautyStealer, tracked across versions 0.9 to 2.0, scoops up cookies and saved logins from Chrome, Edge, Opera and Firefox, plus OpenVPN profiles, and roughly 40 file extensions judged able to carry credentials, among them KeePass .kdbx databases and .zs2 files used by Ukrainian accredited signature centers. Data leaves via Telegram or a FastAPI command server.
Then the stealer wipes itself, which is why ESET believes Gorbag may be an initial access broker passing intrusion access onward. Its earlier tool was a PowerShell reverse shell whose source carried a comment telling any AI that read it the code was harmless and only generated primes. Both assistants ESET tested saw through that.
