ESET Research announcement November 3, 2026; group active since at least February 2025
Gorbag: ESET Names a Russia-Aligned Group Harvesting Credentials Near the Ukraine Front Line
ESET Research announced on November 3 that it has uncovered a Russia-aligned cyberespionage group it calls Gorbag, active since at least February 2025 and focused exclusively on Ukrainian organizations. About a quarter of its targets are law enforcement and justice entities, about a quarter are local administrations and city councils near the front line, and the rest include the defense sector and an entity publicly documented as a major transit hub for foreign military aid. Through 2025 the group used spearphishing emails with malicious attachments dressed in official themes such as administrative fines and taxes. In early 2026 the chain changed: weaponized RAR archives now exploit CVE-2025-8088, a WinRAR path traversal flaw ESET reported in August 2025 after first seeing it exploited as a zero day by RomCom, another Russia-aligned group. Opening a vulnerable archive shows a decoy PDF while dropping a shortcut file into the Windows Startup folder with an encrypted payload and a PowerShell loader. The toolset is small and built for speed: a PowerShell reverse shell ESET calls Prime ReverseShell, and a stealer, BeautyStealer, that takes cookies, stored passwords and local state from Chrome, Edge, Opera and Firefox, OpenVPN configurations, and Office documents, archives, emails and VPN configuration files from the Desktop, Documents and Downloads folders, removable media and mapped network drives. Researcher Damien Schaeffer notes the pattern is one pass of collection followed by the malware trying to remove itself, which may mean Gorbag works as an initial access broker handing credentials to other actors. One reverse shell variant even carries a script comment written to deceive AI assistants and security products that review the file; ESET tested two AI assistants against it and neither was misled.
Executives
Gorbag is a reminder that espionage tradecraft is often plain: a convincing email about a fine or a tax notice, one archive opened, and a few minutes later the browser passwords and VPN configurations are gone. The group appears to harvest and hand off rather than linger, which means the damage can arrive later, from a different actor using the stolen access. For any organization with staff, partners or suppliers in a conflict region, credential hygiene and rapid revocation are the controls that limit the second act.
CIO / CISO
Add the chain to your detection review: weaponized RAR delivery, exploitation of CVE-2025-8088, shortcut files written to Startup folders, and PowerShell loaders decrypting staged payloads. Confirm WinRAR across the estate is past the vulnerable versions, and treat browser credential stores as the target they are: where staff must store passwords in browsers, pair that with endpoint detection that watches for stealer behavior and a revocation runbook that can kill sessions, VPN certificates and saved credentials in one motion.
Engineers
Hunt for the sequence rather than a single indicator: archive extraction followed by a new Startup shortcut, a PowerShell process spawning from an archive tool, and bulk reads of browser profile folders, OpenVPN configuration paths and the standard document folders in a short window. Test your mail gateway handling of RAR attachments with official-looking lures, since that was the delivery vehicle for a full year before the exploit chain arrived.
Everyone (non-IT)
An email about a fine, a tax or an official penalty that arrives with an archive attached deserves suspicion even when the letterhead looks right, especially if it urges you to open it quickly. Open attachments like that only after checking through a separate channel, keep WinRAR and your browser updated, and use a password manager rather than letting the browser remember passwords for important accounts.