Gorbag Phishes Ukrainian Councils With Tax Lures

Russia-aligned group Gorbag targeted Ukrainian government, justice, defense, and transport organizations with spearphishing emails disguised as routine administrative fines and tax notices. The group used compromised government email accounts and weaponized attachments to steal browser passwords, VPN settings, and sensitive documents before attempting to erase its malware.

Key findings

• Gorbag has targeted Ukrainian organizations since at least February 2025, including law enforcement, justice bodies, city councils, defense entities, and a transportation hub for foreign military aid.
• Its phishing lures used routine administrative business themes, specifically administrative fines and tax notices.
• In one case, the phishing email was sent from a compromised account belonging to a local government in Ukraine's Uzhhorod region.
• Earlier campaigns used macro-enabled Excel attachments; later activity used RAR archives exploiting CVE-2025-8088 while showing a decoy PDF.
• BeautyStealer collected browser cookies and passwords, VPN configurations, electronic-signature key files, and selected documents, then attempted to remove itself.

Who’s being targeted

• Commonly targeted roles: Government and city-council employees, Law enforcement and justice personnel, Defense-sector staff, Transportation and logistics personnel, Finance and tax-processing staff, Employees who handle digital certificates, VPNs, or sensitive documents.
• Affected industries: Local government, Law enforcement and justice, Defense, Transportation and logistics.
• Attack channels: email.
• Impersonated: A government or administrative authority, potentially using a compromised local-government email account., An unspecified business or government correspondence sender..

Awareness takeaways

• Treat unexpected fine, tax, and administrative-document attachments as suspicious, even when they appear to be routine office business.
• Do not trust an email solely because it comes from a recognized government or partner address; verify unexpected attachments using a known phone number or official contact channel.
• Avoid opening unexpected RAR archives, especially when the stated purpose is simply to read a document; request the document through an approved sharing method instead.
• Protect browser-saved passwords, VPN configurations, and electronic-signature files as high-value assets, because attackers actively seek them after a phishing success.

Red flags to watch for

• An unexpected fine or tax notice includes a macro-enabled spreadsheet.
• The sender may be a known government contact whose account has been compromised.
• The message pressures the recipient to open an attachment rather than use an official government portal.
• A routine document is delivered as a RAR archive rather than through a normal document-sharing process.
• The archive displays a PDF but creates unexpected files in the Windows Startup folder.
• Unexpected archives should not be opened without confirming the sender through a known contact method.