Russia Smashes and Grabs Credentials in Ukrainian Campaign

A Russia-aligned cyberespionage group has been harvesting data from Ukrainian law enforcement, its defense sector and local governments near the front lines of the war with Russia, researchers found.

See Also: A Darkening Landscape: AI, Friend and Foe of Cyber Resilience

The underreported infostealer operator, tracked as Gorbag by cybersecurity firm Eset, has been delivering malicious attachments in spear-phishing emails since February 2025 and focuses on the exfiltration of secrets valuable to initial access brokers.

"Rather than relying on sophisticated implants for long-term access, Gorbag uses a small toolset built for rapid collection," said Eset researcher Damien Schaeffer, who discovered the malware. "Browser credentials, VPN configurations and selected documents are gathered in a single pass before the deployed malware attempts to remove itself."

"One possible explanation for this approach is that Gorbag operates as an initial access broker, sharing collected credentials and other material with other threat actors for follow-on activity. If so, Gorbag may represent only the first stage of a longer intrusion chain whose later stages remain to be observed," Schaeffer said.

The victim profile and immediate data exfiltration echo the findings in the Ukrainian government's threat intelligence report on Russia's cyber tactics in 2023.

Gorbag's targeting of Ukrainian law enforcement and judiciary departments closely aligns with Russia's wartime interest, Schaeffer said. The threat actor likely aims to monitor or disrupt efforts to document and prosecute Russian war crimes in Ukraine, as well as investigations into Russian assets and collaborators.

The threat actor has attempted to infiltrate local city councils close to where Russian forces have massed within Ukraine. Since most of the targeted municipalities were hit by Russian airstrikes during Gorbag's campaign, Eset said Russia was possibly attempting to assess the effectiveness of its attacks by accessing government records of damage and to learn civil defense initiatives.

Throughout 2025, Gorbag sent spear-phishing emails faking official government communication topics such as administrative fines or taxes.

In one example that Eset found on the malware scanning platform VirusTotal, the malicious email came from a compromised email account belonging to the local government of the Uzhhorod region in western Ukraine. If the victim opened the attached macro-enabled Excel spreadsheet - purportedly showing administrative fines imposed on employees - a simple script would decode a payload hidden in the spreadsheet cells, save it to a system folder and run it.

The chain of compromise changed in early 2026 and began delivering weaponized RAR archives. The threat actor exploited a WinRAR path traversal vulnerability, tracked as CVE-2025-8088, which allowed execution of arbitrary code by crafting malicious archive files.

When opened on a vulnerable system, the archive displays a PDF decoy while dropping a Windows shortcut file, an encrypted payload and a PowerShell loader. The shortcut file helps establish persistence by triggering the loader during each system restart.

The payload, named BeautyStealer and written in C++, is Gorbag's main infostealer. It harvests cookies, stored passwords and local state from the Chrome, Edge, Opera and Firefox browsers, OpenVPN configurations from both user and system directories, and files mostly from Microsoft Office, archives, emails and VPN configurations, Eset said.

The infostealer's early versions only targeted credentials stored in browsers. It has since added more file-stealing capabilities and adopted more complex encryption, exfiltration and self-deletion mechanisms.

"In the case of Gorbag, simple infostealers and a reverse shell are enough to support targeted intelligence collection against Ukrainian organizations of clear wartime interest to Russia," Eset said.