Loading threat actor…
Gorbag is a Russia-aligned cyberespionage group active since at least February 2025. Its activity overlaps with the clusters tracked as UAC-0226 and SHADOW-EARTH-066. Identified targets are exclusively in Ukraine, particularly near the front line and the Russian border. The group targets justice and law enforcement institutions, local administrations, defense organizations, and transportation infrastructure supporting foreign military assistance. Justice and law enforcement bodies account for approximately one quarter of identified targets, with local administrations, predominantly city councils, accounting for another quarter. Its targeting aligns with Russian wartime intelligence priorities; a specific state sponsor or operational base has not been established. Gorbag delivers spearphishing emails impersonating official communications about administrative fines and taxes, including messages sent from compromised government email accounts. During 2025, it used macro-enabled Excel attachments to execute its custom C++ information stealer, BeautyStealer. In early 2026, it adopted malicious RAR archives exploiting the WinRAR path traversal vulnerability CVE-2025-8088. These archives display a decoy document while deploying an encrypted payload, a PowerShell loader, and a shortcut that establishes persistence through the Windows Startup folder. BeautyStealer collects saved browser passwords, session cookies, browsing data, OpenVPN configurations, documents, and authentication material, including electronic-signature private keys. It searches local user folders, removable media, and mapped network drives, archives collected information, and exfiltrates it through Telegram or a custom server. The malware attempts to delete itself afterward, reflecting an emphasis on rapid, single-pass intelligence collection rather than sustained remote access. Earlier operations used Prime ReverseShell, a PowerShell-based tool derived from publicly available code that supports remote command execution over HTTPS.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
21 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
3 malware families Mallory has associated with this actor across public reporting.
1 CVE Mallory has associated with this actor across public reporting. 1 of them is exploited in the wild (not necessarily by this actor).
15 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.