Gorbag Orcs at the Border Harvesting Intelligence from Ukraine
Gorbag: Orcs at the Border Harvesting Intelligence from Ukraine
ESET researchers have been tracking a Russia-aligned threat actor that we named Gorbag. Active since at least February 2025, the group has focused exclusively on Ukrainian targets, with a clear preference for law enforcement and justice entities, local administrations near the front line, and the defense sector. Rather than relying on sophisticated implants for long-term access, Gorbag uses a small toolset built for rapid intelligence collection. Browser credentials, VPN configurations, and selected documents are gathered in a single pass before the deployed malware attempts to remove itself. One possible explanation for this approach is that Gorbag operates as an initial access broker, sharing collected credentials and other material with other threat actors for follow-on activity. Its targeting choices closely align with Russia’s wartime intelligence priorities.
All Gorbag targets identified by ESET Research are located in Ukraine, and the group’s targeting choices fall into three main areas that align closely with Russian wartime intelligence priorities. About a quarter of Gorbag’s targets are Ukrainian governmental organizations active in the law enforcement and justice sectors. The motivations identified at the time probably remain relevant today - monitoring, and potentially disrupting, Ukrainian efforts to document and prosecute war crimes committed by Russian forces, and gaining visibility into investigations aimed at identifying Russian assets and collaborators on Ukrainian soil. Another quarter of Gorbag’s targets are local governmental entities, most of them city councils in areas close to the front line. The remaining targets include a variety of entities in the defense sector, as well as an entity that has been publicly documented as a major transportation hub for foreign military aid.
Throughout 2025, Gorbag relied on spearphishing emails containing a malicious attachment. The lure documents used official or governmental themes, such as administrative fines or taxes. If the victim enables macros, or if their security settings allow the macro to run automatically, a short and not very elaborate VBA routine decodes a base64-encoded payload embedded in the spreadsheet cells, drops it into %ProgramData%, and executes it. That payload is BeautyStealer, Gorbag’s main data-harvesting tool. In early 2026, the compromise chain changed, and Gorbag began delivering weaponized RAR archives that exploit CVE-2025-8088, a WinRAR path traversal vulnerability reported by ESET Research in August 2025 that allows specially crafted data stored in alternate data streams to be extracted outside the user-selected directory. When opened on a vulnerable system, the archive displays a decoy PDF file while dropping a LNK file into the Windows Startup folder, along with an encrypted payload and a PowerShell loader in %ProgramData%. The LNK file provides persistence by triggering the loader on subsequent system startups or restarts.
The group’s main data-collection tool is BeautyStealer, a C++ browser-data and file stealer that we tracked across several versions, from 0.9 to 2.0. BeautyStealer targets: cookies, stored passwords, and local state from the Chrome, Edge, Opera, and Firefox browsers, OpenVPN configurations from both user and system directories, and files with specific extensions - mostly Microsoft Office documents, archives, emails, and VPN configurations - located in the victim’s Desktop, Documents, and Downloads folders, as well as on removable media and mapped network drives. Combining the capabilities seen across multiple versions, BeautyStealer can collect potentially interesting files using extensions like .txt, .doc, .docx, .ovpn, .xls, .xlsx, .xlsm, .eml, .kdbx, .tar, .rar, .zip, .pdf, .ppt, .pptx, .conf, .jks, .rdp, .pfx, or .json. At the time of discovery in February 2025, and before the group deployed its custom infostealer, Gorbag relied on Prime ReverseShell - a PowerShell reverse shell embedded in a .NET binary via the PS2EXE tool - to execute commands on compromised systems and return the output to its C&C server.