A Russia-aligned hacking group that researchers had not previously named or documented has been running a systematic intelligence campaign against Ukrainian institutions since at least February 2025, targeting courts, prosecutors, local government bodies, and a major foreign military aid hub, according to a report published Tuesday by cybersecurity firm ESET.
The group, which ESET has labeled Gorbag, operates with a focused mandate: collect documents and credentials that give Russian intelligence visibility into how Ukraine is tracking war crimes, where foreign weapons are arriving, and how effectively Russian strikes are degrading infrastructure near the front lines. ESET said the group "demonstrates precise targeting and operational intent to contribute to Russia's broader strategic goals in the war with Ukraine."
About a quarter of Gorbag's known targets are law enforcement and judicial institutions. ESET researchers say this pattern points to Russian efforts to monitor ongoing war crimes investigations, including which soldiers and officers have been identified, what evidence has been gathered, and which individuals face prosecution. Courts and prosecutors hold precisely that case material, and the Kremlin would have an obvious interest in knowing what investigators know.
Another quarter of the group's victims are local government bodies, concentrated among city councils operating near active fighting. These are not high-profile targets on their own, but they hold something specific: internal damage assessments from Russian airstrikes, including infrastructure repair estimates that have never been publicly released. For Russian military planners evaluating whether strikes are achieving their intended effect, that internal accounting is far more useful than what appears in news reports.
ESET also identified a major transportation hub for foreign military aid as a Gorbag target, one that had been previously struck in Russian airstrikes. Its inclusion in the campaign fits a third intelligence priority the firm attributes to the group: tracking inbound weapons deliveries and mapping the logistics infrastructure that moves military equipment into Ukraine from abroad.
Getting in through the mailbox
Gorbag's entry method is phishing, specifically emails carrying malicious attachments formatted to look like official correspondence about administrative penalties or outstanding taxes. The choice of lure is deliberate. Administrative staff in Ukrainian municipal offices process exactly these kinds of documents, and a notice framed as an overdue government fine is designed to generate urgency without triggering immediate suspicion.
Once a machine is compromised, Gorbag deploys a custom info-stealer ESET calls BeautyStealer. The tool searches the infected computer, removable drives, and connected network shares for files of value, then attempts to erase itself after sending the data out, limiting what forensic investigators would find. The group also uses a remote access tool called Prime ReverseShell, built on publicly available code, that allows operators to issue commands to a compromised machine directly.
What BeautyStealer collects is a combination of credentials and documents. Saved browser passwords, authentication cookies, VPN configuration files, Microsoft Office documents, email archives, and compressed files all fall within scope. That mixture is significant: credentials open doors to systems the attacker has not yet reached, while the documents provide the raw intelligence. ESET notes Gorbag may pass stolen credentials to separate groups for follow-on intrusions, though this relationship has not been confirmed.
An old flaw put to new use
Starting in early 2026, Gorbag added another technique. The group began exploiting CVE-2025-8088, a path traversal vulnerability in WinRAR that lets an attacker write files outside an intended extraction folder by abusing NTFS Alternate Data Streams. The flaw was patched in July 2025, but systems running older versions remained open. WinRAR is used extensively across Ukrainian organizations, making it a consistent point of interest for Russia-aligned actors. RomCom, another Russian-linked group, had exploited the same vulnerability before Gorbag adopted it.
"As long as the war in Ukraine continues, we expect groups such as Gorbag to remain a persistent threat to Ukrainian government, justice, and defense entities." [ESET researchers]
ESET characterizes Gorbag as less technically sophisticated than elite Russian state hacking units. The group shows little interest in deep persistence or careful lateral movement through networks over time. Its posture is transactional: access a machine, harvest whatever is reachable, and exit. That approach may reflect a division of labor inside Russia's intelligence apparatus, where collection-focused units gather raw material and pass it upstream to actors with more specialized capabilities.
The targeting reinforces that reading. Gorbag is not hitting central government ministries or high-value military command networks in Kyiv. It is operating at the administrative layer of a country at war, the city councils, the courts, the logistics checkpoints, the bureaucratic infrastructure that underpins both civilian governance and military operations near the contact line. That is exactly where granular, operational intelligence lives, and exactly where it is least expected to be a target.
