Russia-aligned cyberespionage group Gorbag has targeted Ukrainian justice, law enforcement, local government and defense organizations since at least February 2025, according to ESET. The firm named the group after research by Damien Schaeffer, published on November 3 and presented at Virus Bulletin in October.
ESET found targets only in Ukraine, many near the Russian border. About a quarter were justice and law enforcement bodies. Another quarter were local administrations, mostly city councils near the front line. The rest included defense entities and an organization publicly documented as a major transport hub for foreign military aid.
ESET said the target choices closely align with Russia's wartime intelligence priorities. It pointed to possible interest in war-crimes prosecutions, damage from air strikes and incoming military supplies.
In 2025, Gorbag sent spearphishing emails themed around administrative fines and taxes. One came from a compromised local government account. The emails carried macro-enabled Excel files that dropped its stealer.
In early 2026, the group switched to RAR archives that exploit CVE-2025-8088, a WinRAR path traversal flaw. ESET reported the flaw in August 2025 after seeing RomCom, another Russ