Skip to content
securitytabs

LiveUpdated

ESET Details Gorbag, a Russia-Aligned Group Stealing Data From Ukrainian Bodies

Security firm ESET says a group aligned with Russia has been using simple data-stealing programs against Ukrainian justice, local government and defense organizations. Organizations outside Ukraine are not named as targets, so no urgent action is indicated.

Data-stealing malware aimed at Ukrainian government bodies
Data-stealing malware aimed at Ukrainian government bodies

What's new

Newest coverage

TimelineWhat should my organization do?

What happened

ESET researchers describe a Russia-aligned group they call Gorbag that uses simple information-stealing malware (software that harvests files and credentials) to collect data from Ukrainian organizations near the front line. [1][2]

ESET says the group has been active since at least February 2025 and has focused exclusively on Ukrainian targets, with a clear preference for law enforcement and justice entities, local administrations near the front line, and the defense sector. [2][3]

Method

The Hacker News reports that the attacks exploit a flaw in the WinRAR archive tool to deploy the data-stealing malware. ESET's published summary describes the tools as simple infostealers. [2][1]

What is not yet known

The available excerpts do not give victim counts, indicators of compromise or mitigation steps beyond ESET's own report. [1][2][3]

Timeline

  1. ESET named law enforcement, justice, local administrations near the front line and defense as the group's preferred targets. [3]

  2. ESET said Gorbag has focused exclusively on Ukrainian targets since at least February 2025. [2]

  3. ESET published research describing the Gorbag group and its use of simple infostealers. [1]

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

ESET says Gorbag targets only Ukrainian organizations, so most small firms elsewhere are not described as targets. [2]

What to do

  1. If you work with Ukrainian partners, ask your IT provider whether they have reviewed ESET's report. [1]
  2. Ask your IT provider to confirm that WinRAR, if used, is up to date, since the group is reported to exploit a WinRAR flaw. [2]

Mid-size company

A small IT or security team

What to know

The group is reported to use a WinRAR flaw and simple infostealers against Ukrainian targets; no wider targeting is reported. [2]

What to do

  1. Review ESET's Gorbag report for indicators and compare them with your logs if you have Ukrainian operations or partners. [1]
  2. Check that WinRAR installations are on an up-to-date version. [2]

Large enterprise

A security operations team

What to know

ESET attributes the activity to a Russia-aligned actor focused on justice, local government and defense bodies in Ukraine. [2][3]

What to do

  1. Use ESET's published details to hunt for Gorbag activity in environments connected to Ukrainian entities. [1]
  2. Confirm that WinRAR installations are on an up-to-date version, since the group is reported to exploit a WinRAR flaw. [2]

Sources

  1. [1]ESET WeLiveSecurity · Nov 3, 09:50 UTC
    Gorbag: Orcs at the border harvesting intelligence from Ukrainecontext
  2. [2]The Hacker News · Nov 3, 11:00 UTC
    Russia-Aligned Gorbag Hackers Exploit WinRAR Flaw to Deploy Data-Stealing Malwarecontext
  3. [3]Infosecurity Magazine · Nov 3, 15:30 UTC
    Russia-Aligned Gorbag Targets Ukraine for Intelligencecontext