Overview
A Russia-aligned threat actor known as Gorbag, tracked as UAC-0226 by CERT-UA and SHADOW-EARTH-066 by Trend Micro, has been using relatively simple information stealers against Ukrainian organizations. ESET says the group has been active since at least February 2025 and focuses exclusively on Ukrainian targets, with a preference for law enforcement and justice entities, local administrations near the front line, and the defense sector.
Initial Access
Attacks begin with spear-phishing emails carrying malicious attachments and official-looking lures, such as administrative fines or taxes. In one case, a macro-enabled Excel file (.XLSM) runs a VBA payload that decodes and executes the BeautyStealer malware.
Per Trend Micro, the group also exploited CVE-2025-8088, a now-patched WinRAR vulnerability, to trigger a DLL sideloading chain that runs GIFTEDCROOK.
Malware Toolkit
| Malware | Description |
|---|---|
| GIFTEDCROOK | C/C++ stealer that takes cookies, browsing history, and authentication data from Chrome, Edge, and Firefox |
| BeautyStealer | Main data-harvesting tool; collects browser data, OpenVPN configs, Office documents, KeePass databases, and RDP configurations. Sends archives to a Telegram chat or a FastAPI-based C2 server, then removes itself |
| Prime ReverseShell | Reverse shell derived from PSSW100AVB, used in early 2025 waves and flagged by CERT-UA in April 2025 |
ESET suggests Gorbag may be an initial access broker that passes stolen data to other actors. ESET researcher Damien Schaeffer also noted a script containing a comment aimed at AI tools, intended to make them dismiss it as benign. Testing with two AI assistants found the injection ineffective; both correctly identified the file as a reverse shell.
Defensive Recommendations
- Update WinRAR to a version that fixes CVE-2025-8088, and inventory other archive tools.
- Disable Office macros from the internet by default and block
.XLSMattachments from untrusted senders. - Protect browser-stored credentials. Use a password manager and enforce short session lifetimes to limit stolen cookie value.
- Secure KeePass databases and VPN/RDP configuration files, and avoid leaving them in user-readable locations.
- Monitor egress to Telegram APIs and unfamiliar FastAPI-style endpoints from workstations.
- Review the ESET report for indicators of compromise; none were listed in the news coverage.