Gorbag APT group targets Ukrainian organizations with self-deleting malware
Original title: Gorbag APT group hits Ukrainian courts and city councils with self-deleting malware
Gorbag APT uses BeautyStealer that erases itself after collecting credentials from Ukrainian law enforcement, city councils and defense entities.
ESET tracked Russia-aligned Gorbag APT since February 2025 targeting Ukrainian organizations via spearphishing attachments. Early lures used macro-enabled Excel files; later RAR archives exploited CVE-2025-8088 to drop a PowerShell loader. BeautyStealer C++ stealer collects passwords, VPN configs and files with 40 extensions before self-deletion. Targets include law enforcement, city councils near front lines and defense entities. ESET researchers note the approach suits rapid credential theft possibly for initial access brokering.
Unconfirmed: Russia alignment is stated by ESET but unverified independently.
- BeautyStealer steals cookies, passwords, OpenVPN configs and files with 40 extensions.
- Malware self-deletes after data collection.
- RAR attachments exploit CVE-2025-8088 path traversal.
- LNK files enable persistence in Startup folder.
- Targets align with Russian wartime priorities.
Impact: steals credentials, VPN configs and documents from Ukrainian government entities
| Product | Affected |
|---|---|
| BeautyStealer | — |
- CVEs
- CVE-2025-8088
- Vendors
- ESET
- Threat actors
- Gorbag
- Malware
- BeautyStealer
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-8088 | WinRAR Path Traversal (CVE-2025-8088) Enables Arbitrary Code Execution | 8.4 | 94% | KEVRansomware | KEV |
From the original article
2 min read at helpnetsecurity.com
ESET has been tracking a Russia-aligned group it calls Gorbag, which has been breaking into Ukrainian organizations since at least February 2025 using spearphishing attachments and a stealer that erases itself once the data is gone. Spearphishing email message from a compromised email sender (Source: ESET) Every target ESET identified sits in Ukraine.
By Anamarija Pogorelec · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.