Gorbag cyber group targets Ukrainian defense and judicial sectors

A Russia-aligned hacking group known as Gorbag has been targeting Ukrainian government agencies, defense organizations, and infrastructure used for transporting foreign military aid, according to researchers from ESET.

Active since at least February 2025, the group utilizes relatively simple malware, including the exploitation of a WinRAR vulnerability (CVE-2025-8088) via a DLL sideloading chain. The attackers focus on stealing sensitive documents, login credentials, and data from browsers and VPN setups. Unlike many espionage groups that prioritize long-term network persistence, Gorbag appears to focus on rapid data theft before removing traces of its presence.

The group’s targets align with Russian intelligence priorities. Approximately 25 percent of targets are Ukrainian law enforcement and judicial institutions, which may be used to monitor investigations into alleged Russian war crimes. Another 25 percent are local government bodies, particularly city councils near the front lines. These entities often hold non-public information regarding damage from airstrikes and critical infrastructure repairs. Other targets include defense organizations and entities involved in military supply routes.