New Russia-linked hacking group Gorbag targets Ukraine's war crimes probes

Unlike cyberespionage groups that try to keep access to compromised networks for months, Gorbag appears focused on grabbing information quickly and then removing traces of its malware, researchers said. About a quarter of its known targets are Ukrainian law enforcement and judicial institutions, which ESET said could point to monitoring of investigations into alleged Russian war crimes and efforts to identify Russian operatives and collaborators. Another quarter are local government bodies, mostly city councils near the front line, whose records of airstrike damage, including infrastructure assessments and repair estimates not publicly disclosed, could help Russian forces judge how effective their attacks have been.

The attacks begin with phishing emails carrying malicious attachments disguised as official documents about administrative fines or taxes. Once opened, the hackers can steal saved browser passwords, cookies, VPN configurations and selected files. Their main tool, BeautyStealer, searches computers, removable drives and network drives for valuable files, then deletes itself after sending the loot. In early 2026 the group also began exploiting a previously disclosed WinRAR flaw, tracked as CVE-2025-8088, which was patched in July 2025 and had earlier been exploited by RomCom, another Russia-aligned group linked to cybercrime and espionage.

ESET suggested Gorbag's hit-and-run approach could indicate cooperation with other hacking groups, passing stolen credentials and documents to operators who carry out later intrusions, though researchers have not established whether that is happening. "Despite its relatively unsophisticated toolset, the group demonstrates precise targeting and operational intent to contribute to Russia's broader strategic goals in the war with Ukraine," ESET said.