Actor Profile

Gorbag is a Russia-aligned threat actor active since at least February 2025, conducting cyber espionage operations exclusively against Ukrainian targets. Also tracked as UAC-0226 by CERT-UA and SHADOW-EARTH-066 by Trend Micro, the group focuses on wartime intelligence collection aligned with Russian strategic priorities. Gorbag employs relatively simple information stealer malware rather than sophisticated tooling, suggesting a pragmatic approach to targeted data theft. The actor may function as an initial access broker, harvesting credentials and sensitive data for handoff to other threat actors for follow-on exploitation.

TTPs (Tactics, Techniques, Procedures)

Gorbag leverages spear-phishing emails with government-themed lures (administrative fines, taxes) containing malicious attachments. The group exploited CVE-2025-8088, a WinRAR vulnerability, to trigger DLL sideloading chains executing GIFTEDCROOK stealer malware. Macro-enabled Excel spreadsheets (.XLSM) deliver VBA payloads that decode and execute BeautyStealer, an evolved variant of GIFTEDCROOK. BeautyStealer harvests browser data (Chrome, Edge, Opera, Firefox), VPN configurations (OpenVPN), documents (Office files, archives, emails, KeePass databases, RDP configs), compresses stolen data, and exfiltrates via Telegram or custom FastAPI C2 servers before self-deleting. Early 2025 attacks used Prime ReverseShell (PSSW100AVB derivative) for remote command execution. One Prime ReverseShell variant included prompt injection attempting to deceive AI security tools, though testing showed this was ineffective. Key techniques align with T1566.001 (Spearphishing Attachment), T1204.002 (Malicious File), T1574.002 (DLL Side-Loading), T1555.003 (Credentials from Web Browsers), T1005 (Data from Local System), T1560 (Archive Collected Data), T1041 (Exfiltration Over C2 Channel), and T1070.004 (File Deletion).

Targets & Patterns

Gorbag exclusively targets Ukrainian organizations with clear wartime intelligence value to Russia. Primary targets include law enforcement agencies, justice entities, local government administrations near the front line, and the defense sector. This targeting pattern reflects Russian strategic intelligence priorities during the ongoing conflict, focusing on entities that possess operational information, legal proceedings data, administrative details from conflict zones, and defense-related intelligence. The geographic and sectoral focus suggests collection requirements tied to military operations, counterintelligence, and understanding Ukrainian governmental response capabilities in contested regions.

Historical Context

Gorbag has been active since at least February 2025, with activity tracked by multiple organizations under different names (UAC-0226 by CERT-UA, SHADOW-EARTH-066 by Trend Micro). In June 2025, Trend Micro attributed WinRAR CVE-2025-8088 exploitation to the group. Early 2025 campaigns utilized Prime ReverseShell, flagged by CERT-UA in April 2025. By the end of December 2025, Gorbag completely transitioned from GIFTEDCROOK to the evolved BeautyStealer variant, indicating iterative malware development. The group's consistent focus on Ukrainian targets throughout 2025-2026 demonstrates sustained operational tempo aligned with the Russia-Ukraine conflict timeline.

Defensive Recommendations

  • Patch CVE-2025-8088 in WinRAR immediately and audit systems for DLL sideloading indicators associated with this vulnerability exploitation
  • Block macro-enabled Office documents (.XLSM, .DOCM) at email gateways and enforce Attack Surface Reduction rules to prevent VBA macro execution from untrusted sources
  • Monitor for suspicious browser credential access (T1555.003) using tools like Sysmon Event ID 10 (ProcessAccess) targeting browser processes (chrome.exe, msedge.exe, firefox.exe) and credential stores
  • Detect exfiltration to Telegram APIs and unusual FastAPI C2 traffic patterns; baseline normal Telegram usage and alert on POST requests to Telegram bot APIs from non-standard processes
  • Implement behavioral detection for file collection activity targeting VPN configs, RDP files, KeePass databases, and bulk document archiving (T1560) followed by network connections, especially from Office processes or scripting interpreters

---

# Geopolitical Context

Geopolitical Context

The Gorbag campaign represents a sustained cyber espionage effort consistent with Russia's wartime intelligence priorities in Ukraine. Active since at least February 2025, the threat actor—tracked as UAC-0226 by CERT-UA and SHADOW-EARTH-066 by Trend Micro—has concentrated exclusively on Ukrainian targets with strategic value to ongoing military operations. The group's focus on law enforcement, judicial institutions, front-line local administrations, and defense entities reflects intelligence collection requirements aligned with battlefield dynamics and occupation governance planning. The campaign's reliance on commodity information stealers rather than sophisticated implants suggests either resource constraints or a calculated operational security approach favoring disposable tooling. The possibility that Gorbag functions as an initial access broker indicates potential coordination within a broader Russian intelligence ecosystem, where specialized actors handle distinct phases of intrusion chains.

State Actor Alignment

Gorbag is assessed to be Russia-aligned based on targeting patterns and operational focus. ESET research indicates the group's victim selection "closely align[s] with Russia's wartime intelligence priorities," concentrating on Ukrainian law enforcement, justice sector, municipal administrations near active combat zones, and defense organizations. The campaign timeline—beginning in February 2025 and continuing through at least late 2025—corresponds with the ongoing Russo-Ukrainian conflict. CERT-UA's tracking of the activity as UAC-0226 further supports attribution to Russian-nexus operations. While no formal state attribution to specific Russian intelligence services (GRU, FSB, SVR) is provided in available reporting, the strategic targeting and sustained operational tempo are consistent with state-sponsored cyber espionage rather than financially motivated cybercrime.

Business Impacty pro region

The Gorbag campaign underscores the persistent cyber threat facing Ukrainian critical infrastructure and governance institutions during wartime. The targeting of front-line local administrations suggests intelligence collection aimed at supporting tactical military operations or planning for territorial control and occupation governance. Compromise of law enforcement and judicial entities may facilitate identification of Ukrainian security personnel, informants, or resistance networks—information with direct operational value for Russian forces. The theft of VPN configurations and authentication credentials from defense sector targets poses risks to operational security and military communications. For European allies providing military and intelligence support to Ukraine, the campaign highlights ongoing requirements for defensive cyber assistance and information sharing. The use of commodity malware and publicly disclosed vulnerabilities (CVE-2025-8088 in WinRAR) demonstrates that even unsophisticated tooling can achieve strategic intelligence objectives when paired with effective social engineering and target selection.

Forecast

If Gorbag continues operating as an initial access broker, subsequent intrusion stages conducted by partner threat actors may emerge in coming months, potentially involving destructive attacks or deeper network compromise of already-breached Ukrainian institutions. If Ukrainian defensive measures successfully disrupt current delivery mechanisms—particularly spear-phishing with malicious Office documents—the group is likely to adapt tactics, potentially exploiting additional software vulnerabilities or shifting to alternative social engineering themes. If the operational tempo and targeting patterns persist, this would suggest Gorbag retains tasking priority within Russian intelligence collection requirements, indicating continued focus on Ukrainian governance and defense sectors. If Western security vendors maintain detection coverage for BeautyStealer and associated tooling, the threat actor may be compelled to develop or acquire alternative malware families, though the current low-sophistication approach appears operationally sufficient for their objectives.