ESET exposes Gorbag, the Russia-aligned broker harvesting Ukraine intel

ESET Research has identified a previously undocumented Russia-aligned threat group, dubbed Gorbag, conducting highly targeted cyberespionage operations against Ukrainian organisations since at least February 2025. Rather than pursuing persistent, long-term network access, Gorbag deploys a lean toolset designed for rapid, single-pass data collection, browser credentials, VPN configurations, and selected documents, before the malware attempts to erase itself. The pattern points strongly towards an initial access broker model, in which harvested credentials are passed upstream to other Russia-aligned actors for deeper exploitation.

ESET researcher Damien Schaeffer, who discovered and investigated the group, says: "One possible explanation for this approach is that Gorbag operates as an initial access broker, sharing collected credentials and other material with other threat actors for follow-on activity. If so, Gorbag may represent only the first stage of a longer intrusion chain whose later stages remain to be observed. Its targeting choices closely align with Russia's wartime intelligence priorities."

Wartime targeting with surgical precision

The group's victim profile is tightly scoped. Roughly a quarter of targets are Ukrainian governmental entities active in law enforcement and justice, institutions that have been systematically building war-crimes dossiers, with several hundred indictments already filed. Another quarter are local city councils in front-line regions, where intelligence value likely spans battle-damage assessment and monitoring of community-level defence initiatives. The remainder spans the defence sector broadly and, notably, a logistics node publicly documented as a major conduit for foreign military aid, the same infrastructure that has drawn Russian air strikes, suggesting Gorbag's interest blends damage assessment with visibility into inbound supply flows.

Delivery began with spearphishing emails carrying attachments styled as official documents: administrative fines, tax notices and similar government-themed lures. In early 2026, the group upgraded its compromise chain to weaponise CVE-2025-8088, a WinRAR path traversal vulnerability that ESET itself discovered and reported in August 2025. When a victim opens the malicious archive, a decoy PDF is displayed while a LNK file is silently dropped into the Windows Startup folder alongside an encrypted payload and a PowerShell loader. ESET notes that the same zero-day was first observed being exploited by RomCom, a separate Russia-aligned group active in both cybercrime and espionage, a detail that hints at shared tooling or at minimum coordinated access to freshly disclosed exploits within the Russian threat-actor ecosystem.

Convergence: cyberespionage meets the defence supply chain

The Gorbag disclosure arrives at a moment when Western governments and NATO member states are under growing pressure to scrutinise the digital security posture of the entire military-aid logistics chain, not merely the front-line combatants. That Gorbag specifically targeted a foreign military aid transit hub, alongside entities that assess battle damage, illustrates how cyberespionage has become structurally embedded in kinetic warfare: intelligence harvested digitally informs physical strike decisions.

For capital allocators and defence-tech investors, the finding reinforces a macro trend that has been building since 2022. Sovereign defence procurement budgets across Europe and the Indo-Pacific are increasingly ring-fencing funds for cyber-resilience alongside conventional hardware. The initial access broker model that Gorbag appears to follow is particularly corrosive: a single, inexpensive credential-harvesting operation can unlock a chain of downstream intrusions by better-resourced actors, multiplying the strategic damage well beyond what a small toolset would suggest. Cybersecurity vendors with specialist exposure to government and critical-infrastructure verticals, particularly those with threat-intelligence and vulnerability-research capabilities, occupy an increasingly non-discretionary position in defence budgets. ESET's ability to discover and responsibly disclose the WinRAR vulnerability before Gorbag operationalised it at scale is a reminder that the intelligence asymmetry between private security researchers and state-aligned threat actors is narrowing, but has not closed.

ESET Research presented its Gorbag findings at the 2026 Virus Bulletin conference. The group's primary data-collection tool, BeautyStealer, targets major browsers as well as OpenVPN configurations and common document formats across local and removable storage.