Russia-aligned group Gorbag targeted Ukrainian public-sector and defense organizations with spearphishing emails disguised as administrative fines and tax matters. The messages delivered malicious files that stole browser passwords, VPN settings, documents, and electronic-signature keys, potentially enabling further attacks.
Gorbag, a Russia-aligned group, has targeted Ukrainian justice, law-enforcement, local-government, and defense organizations since at least February 2025. The group sent spearphishing emails themed around administrative fines and tax matters, a pretext likely to prompt quick action from recipients who handle official correspondence as part of their jobs. One of these emails was sent from a compromised local-government account, which would have made the message appear more legitimate to its recipients.
The emails carried macro-enabled Excel files that dropped a stealer called BeautyStealer. Later in the campaign, the group shifted to malicious RAR archives that exploited a WinRAR path-traversal flaw to deliver the same payload. Once executed, BeautyStealer collected browser cookies and saved passwords from Chrome, Edge, Opera, and Firefox, along with OpenVPN configurations, documents, and Ukrainian electronic-signature keys. The stolen data was sent to Telegram or a custom server, after which the malware deleted itself, suggesting it was built for a single collection event rather than ongoing access.
Several factors likely contributed to the campaign's effectiveness:
Defenders and staff in targeted sectors should treat the following as warning signs:
Organizations in government, justice, law enforcement, and defense sectors can reduce exposure by verifying unexpected fine or tax notices through a known official contact channel before opening any attachment. Staff should be trained not to assume a message is safe simply because it comes from a recognizable government account, since legitimate accounts can be compromised. Avoiding macro-enabled spreadsheets and unexpected archive files, especially those claiming to contain urgent official documents, is also important. Finally, protecting browser-stored passwords and VPN configuration files matters, since a single malicious attachment can expose credentials that enable further attacks, including the possibility that stolen access is passed on to other threat actors.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Gorbag sent spearphishing emails themed around administrative fines and tax notices, including one sent from a compromised local government account, targeting Ukrainian public-sector and defense organizations.
The emails delivered macro-enabled Excel files and later malicious RAR archives exploiting a WinRAR path-traversal flaw, both dropping a stealer called BeautyStealer that collected browser passwords, cookies, VPN configurations, documents, and electronic-signature keys.
The lures looked like routine official fine or tax notices, and one was sent from a genuine but compromised government account, making the attachment seem more trustworthy than a typical phishing email.
Verify unexpected fine or tax notices through a known official channel, avoid opening macro-enabled spreadsheets or archive attachments, and protect browser-stored credentials and VPN configuration files.
A fine notice from a local-government account? That could still be a trap. Gorbag sent these emails to Ukrainian public-sector offices. The attachment was a macro-enabled Excel file; later, a RAR archive exploiting a WinRAR flaw. Here’s the catch: even the real government account may be compromised. Open the file, and BeautyStealer can grab saved passwords, VPN settings, and electronic-signature keys. Unexpected fine or tax attachment? Before opening it, call the office using a number you already know.
Russia-aligned Gorbag targeted Ukrainian government, law-enforcement, and defense organizations with spear-phishing emails disguised as official administrative fines or tax notices. The emails carried malicious attachments, including macro-enabled Excel files, that installed data-stealing malware…
Russia-aligned Gorbag has targeted Ukrainian government, justice, defense, and logistics organizations with convincing spearphishing emails. The group used a compromised local-government email account to send a fake administrative-fines notice with a malicious Excel attachment, then shifted to…
A Ukraine-based grain logistics company was breached through a spearphishing email carrying a malicious attachment. UAC-0099 used the access to install backdoors, then handed access to Sandworm, which later deployed a data-wiping attack. The initial email attachment is a realistic…
Russia-aligned group Gorbag targeted Ukrainian government, justice, defense, and military-aid transport organizations with phishing emails carrying malicious attachments. The emails were disguised as official administrative fine or tax documents, and opening them enabled theft of passwords, VPN…
Attackers sent Korean-language emails posing as FedEx tax invoices to pressure billing and payment staff into opening a ZIP attachment. The attachment contains a blank-looking PDF that asks the recipient to approve a security prompt, allowing hidden commands to launch malware on Windows.
UK, US, and Dutch authorities reported Iranian state-linked cyber actors using social messaging apps like Telegram and WhatsApp to build trust with dissidents, activists, and journalists. The actors then convince targets to open “legitimate-looking” files (fake apps or documents like MRI results)…
