Executive Summary
Gorbag, a Russia-aligned threat group (also tracked as UAC-0226), has been actively targeting Ukrainian law enforcement, justice entities, and defense sectors since early 2025. The group utilizes a combination of spear-phishing and vulnerability exploitation to harvest sensitive intelligence. Their targeting choices align closely with Russian wartime intelligence priorities, potentially serving as an initial access broker for more complex follow-on intrusions.
The attack chain involves weaponizing a now-patched WinRAR vulnerability (CVE-2025-8088) to trigger DLL sideloading, or using macro-enabled Excel documents to deliver the BeautyStealer or GIFTEDCROOK infostealers. These tools are designed to exfiltrate browser data, VPN configurations, and sensitive documents (including KeePass databases and RDP files) to Telegram or FastAPI-based C2 servers. Notably, the group has experimented with prompt injection techniques in their code to attempt to deceive AI-based security scanners.
While the malware itself is relatively simple, the group’s persistent focus on critical Ukrainian administrative and defense infrastructure makes them a significant threat. Their transition to the BeautyStealer variant in late 2025 indicates an evolving toolkit focused on efficient, one-off data harvesting and immediate self-deletion to minimize their footprint.