ESET Uncovers Russia-Aligned Gorbag Cyber Espionage Targeting Ukraine's Defense Sector

Slovak cybersecurity company ESET has published new research detailing the operations of Gorbag, a Russia-aligned cyber espionage group targeting Ukrainian government institutions, defense organizations and infrastructure associated with foreign military assistance.

According to findings released on November 3, Gorbag has been active since at least February 2025, conducting targeted campaigns against organizations whose activities align closely with Russia's wartime intelligence interests.

The group has focused on Ukrainian law enforcement and judicial institutions, municipal authorities near the front line and organizations connected to defense and military logistics.

Cyberattacks Target Military Aid and Government Networks

ESET researchers identified an entity described as a major transportation hub for foreign military assistance among the group's targets.

The facility, which ESET did not publicly identify in its report, has also been subjected to Russian airstrikes.

Researchers assessed that the targeting could provide information about incoming military supplies, the condition of infrastructure or damage caused by previous attacks.

Gorbag also targeted local administrations responsible for assessing damage to civilian infrastructure and coordinating activities close to the front line.

Such information may have intelligence value because it can reveal the operational consequences of airstrikes, reconstruction activity and local defense preparations.

Approximately one-quarter of the identified targets belonged to Ukraine's law enforcement and justice sectors, according to ESET.

Gorbag Uses Simple Malware to Collect Sensitive Information

Unlike groups that prioritize persistent access to compromised networks, Gorbag appears focused on collecting information rapidly.

Its tools include BeautyStealer, malware designed to extract browser credentials and selected files, and Prime ReverseShell, a PowerShell-based remote-access component.

The group has also sought VPN configurations and documents that could enable subsequent access to protected systems.

Initial attacks relied on spearphishing messages containing malicious documents, including spreadsheets disguised as administrative communications.

In early 2026, Gorbag modified its infection process to exploit CVE-2025-8088, a previously disclosed WinRAR vulnerability that can enable malicious files to be placed outside the intended extraction directory.

ESET says the group's tools may remove themselves after completing data collection.

Researchers suggested that Gorbag could potentially function as an initial access broker, supplying stolen credentials or intelligence to other threat actors. That role remains an assessment rather than a confirmed operational relationship.

Intelligence Collection Remains a Persistent Wartime Threat

ESET has not publicly attributed Gorbag to a specific Russian military or civilian intelligence service.

However, its concentration on Ukrainian defense-related targets and government organizations supports the researchers' assessment that the operation is aligned with Russian strategic interests.

The findings add to a broader pattern of cyber espionage targeting European security institutions and critical infrastructure.

AdriaDefense previously examined Russian-linked cyber and intelligence operations affecting European organizations, illustrating the extent to which network intrusions have become part of wider national security competition.

For Ukraine and its international partners, the Gorbag campaign highlights the risks associated with compromised credentials, insecure document handling and exposed digital infrastructure supporting military logistics.

ESET's findings also demonstrate that effective espionage operations do not necessarily require sophisticated malware when attackers can exploit trusted communications and common software vulnerabilities.