Gorbag APT group hits Ukrainian courts and city councils with self-deleting malware
MentionsESET
ESET has been tracking a Russia-aligned group it calls Gorbag, which has been breaking into Ukrainian organizations since at least February 2025 using spearphishing attachments and a stealer that erases itself once the data is gone. Spearphishing email message from a compromised email sender (Source: ESET) Every target ESET identified sits in Ukraine.
Summary from Help Net Security.
Explained
The technology and terms in this story. Learn more