Covered by 2 outlets — first reported by Help Net Security, Nov 3, 10:00 UTC
Gorbag APT group hits Ukrainian courts and city councils with self-deleting malware
MentionsESET
Summary
ESET says a Russia-aligned hacking group it calls Gorbag has been breaking into Ukrainian organizations since at least February 2025, using spearphishing email attachments and a simple data-stealing program that deletes itself once the data is taken. ESET says every target it identified is in Ukraine, with a preference for law enforcement and justice bodies, local administrations near the front line and the defense sector. The Hacker News reports the attacks exploit a WinRAR flaw.
AI summary by the SecurityTabs newsroom, checked against Help Net Security, The Hacker News. Read the outlets below for the full story.
Continue reading
2 outlets, in the order they reported it.
Help Net SecurityFirst report
Gorbag APT group hits Ukrainian courts and city councils with self-deleting malware
ESET has been tracking a Russia-aligned group it calls Gorbag, which has been breaking into Ukrainian organizations since at least February 2025 using spearphishing attachments and a stealer that erases itself once the data is gone.
The Hacker News
Russia-Aligned Gorbag Hackers Exploit WinRAR Flaw to Deploy Data-Stealing Malware
A Russia-aligned threat actor known as Gorbag has been observed using simple information stealer malware in attacks targeting Ukrainian organizations.
Explained
The technology and terms in this story. Learn more
- ConceptAPT · Advanced persistent threatA well-resourced hacking group, usually tied to a government, that runs long, targeted campaigns.
- AttackInfostealerMalware that grabs saved passwords, browser cookies and crypto wallets from an infected computer.
- ConceptExploitCode or a technique that turns a software flaw into something an attacker can actually use.