Russia-aligned Gorbag APT targets Ukrainian entities
Original title: Gorbag: Orcs at the border harvesting intelligence from Ukraine
Gorbag harvests intelligence from Ukrainian law enforcement and frontline administrations using spearphishing since February 2025.
ESET has identified Gorbag, a Russia-aligned threat actor active since February 2025, targeting Ukrainian law enforcement, justice entities, local administrations near the front line, and defense sector. The group uses spearphishing with malicious attachments and tools like Prime ReverseShell and BeautyStealer for one-time data collection. It may act as an initial access broker.
Unconfirmed: The full role of Gorbag as an initial access broker is not confirmed.
- Targets include law enforcement and justice organizations
- Focus on frontline local administrations
- Malware delivered via spearphishing attachments
- Updates compromise chain to abuse CVE-2025-8088 in WinRAR
Impact: gathering intelligence on Ukrainian military and law enforcement activities
| Product | Affected |
|---|---|
| WinRAR | — |
- CVEs
- CVE-2025-8088
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-8088 | WinRAR Path Traversal (CVE-2025-8088) Enables Arbitrary Code Execution | 8.4 | 94% | KEVRansomware | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 142.111.194.73 | A M247 Europe SRL 2025-03-28 Prime ReverseShell C&C server. 142.111.194[.]73 N/A EGIHosting 2026‑06‑02 BeautyStealer exfiltration serv |
| ipv4 | 89.44.9.186 | hive. Network IP Domain Hosting provider First seen Details 89.44.9[.]186 N/A M247 Europe SRL 2025-03-28 Prime ReverseShell C&C ser |
| sha1 | 0589d2079fbef814dc7bb95c4b3b555c8b933af6 | даткова.xlsm VBA/TrojanDropper.Agent.DAT XLS lure document. 0589D2079FBEF814DC7BB95C4B3B555C8B933AF6 Повідомлення 4726-49.rar PowerShell/Agent.EJI LNK/Runner.FB |
| sha1 | a5e0a82bf6cc302a20d917235643b748f73fcc27 | 2E218156FB0940F N/A Win64/PSW.Agent.MA Spearphishing email. A5E0A82BF6CC302A20D917235643B748F73FCC27 Windows Telemetry PowerShell/ReverseShell.OB Prime ReverseS |
| sha1 | c17369b4b49113d07f080df832e218156fb0940f | Hub repository . Files SHA-1 Filename Detection Description C17369B4B49113D07F080DF832E218156FB0940F N/A Win64/PSW.Agent.MA Spearphishing email. A5E0A82BF6CC302 |
| sha1 | e27e0d0a4b308f9b6b0469159931eb5e343e7ff8 | ws Telemetry PowerShell/ReverseShell.OB Prime ReverseShell. E27E0D0A4B308F9B6B0469159931EB5E343E7FF8 додаток податкова.xlsm VBA/TrojanDropper.Agent.DAT XLS lure |
From the original article
10 min read at welivesecurity.com
ESET researchers uncover Gorbag, a Russia-aligned group using simple infostealers to harvest data from Ukrainian organizations near the front line
welivesecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.