Gorbag
Threat actorSecurity timeline
- Activity reported by Infosecurity MagazineRussia-aligned Gorbag targets Ukrainian justice, local government and defence bodies
- Activity reported by The Hacker NewsRussia-aligned Gorbag group uses WinRAR flaw to deploy data-stealing malware
- Activity reported by Help Net SecurityGorbag APT group targets Ukrainian courts and city councils with self-deleting malware
Recent news
Russia-aligned Gorbag targets Ukrainian justice, local government and defence bodies
Russia-aligned actor Gorbag has been targeting Ukrainian justice, local government and defence bodies since 2025, with intelligence gathering as the apparent objective. The article gives no further technical detail on the intrusions.
Russia-aligned Gorbag group uses WinRAR flaw to deploy data-stealing malware
The Russia-aligned threat actor Gorbag is deploying basic information stealer malware against Ukrainian targets, according to ESET researchers. The group has been active since at least February 2025 and focuses on law enforcement, justice entities, front-line local administrations and the defence sector. The article title says the intrusions exploit a WinRAR flaw to deliver the malware.
Gorbag APT group targets Ukrainian courts and city councils with self-deleting malware
ESET is tracking a Russia-aligned group it calls Gorbag, which has targeted Ukrainian organisations since at least February 2025 using spearphishing attachments and a stealer that erases itself after exfiltration. All identified victims are in Ukraine, with about a quarter being law enforcement and justice bodies and another quarter local administrations, mostly city councils.