Russia-aligned Gorbag has targeted Ukrainian government, justice, defense, and logistics organizations with convincing spearphishing emails. The group used a compromised local-government email account to send a fake administrative-fines notice with a malicious Excel attachment, then shifted to weaponized WinRAR archives. Its goal is rapid theft of browser passwords, VPN configurations, and sensitive files rather than long-term access.
Gorbag, a group active against Ukrainian organizations since at least February 2025, built its campaign around spearphishing emails with official or governmental themes, including administrative fines and taxes. One email was sent from a compromised Ukrainian local-government email account, which likely added credibility to the message. The opening line asked recipients to review employee fines and pass the information along immediately, pairing a routine administrative tone with urgency. The attachment was a macro-enabled Excel spreadsheet. If the victim enabled macros, a short VBA routine decoded a base64-encoded payload, starting the infection chain.
In early 2026, Gorbag shifted tactics and began delivering weaponized RAR archives that exploit CVE-2025-8088, a WinRAR path traversal vulnerability. When opened on a vulnerable system, the archive displayed a decoy PDF while quietly dropping a LNK file into the Windows Startup folder, giving the malware persistence without obvious signs of compromise.
The campaign combined believable administrative framing with a compromised sender identity. A message about employee fines sent from a real local-government account removes two of the usual red flags defenders look for: an unfamiliar sender and an implausible topic. The instruction to "convey this information to them immediately" added social pressure to act quickly rather than verify. The later RAR-based approach added a technical layer, using a known vulnerability so a legitimate-looking PDF could mask malicious activity happening in the background.
Organizations in government, law enforcement, justice, defense, and logistics should treat unsolicited administrative documents as suspicious until verified through a separate, known contact channel. Staff should avoid enabling Office macros in unexpected attachments and confirm business need before opening archives. Keeping WinRAR and similar software updated reduces exposure to known vulnerabilities like the one Gorbag exploited. Because the group relies on tools such as T1566.001 for spearphishing attachments and T1204.002 for user execution, training that reinforces pausing before opening unexpected files, regardless of how official they appear, is the most direct defense available.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Gorbag targeted Ukrainian law enforcement and justice bodies, frontline local governments, defense organizations, and a transportation hub associated with foreign military aid.
One phishing email was sent from a compromised Ukrainian local-government email account, which likely gave the message additional credibility, and the lures used official themes such as administrative fines or taxes.
The macro-enabled Excel attachment runs a VBA routine that decodes a base64-encoded payload, while the later RAR archives exploit a WinRAR vulnerability to display a decoy PDF while dropping malicious files onto the system.
The malware, BeautyStealer, collects browser passwords and cookies, OpenVPN configurations, and documents from local folders, removable media, and network drives, then sends the data to Telegram chats or a command-and-control server.
An employee-fines notice from a real local-government address? Gorbag used exactly that. The email says, 'Please convey this information immediately.' Its attached Excel file asks for macros. In newer emails, a RAR archive opens a harmless-looking PDF. A real sender isn't proof it's safe: that account was compromised. The RAR exploits WinRAR flaw CVE-2025-8088, quietly placing a shortcut in Windows Startup while you see the PDF. BeautyStealer can grab browser passwords, VPN settings, and files. Before opening that unexpected notice, call your known government contact to confirm it.
Russia-aligned group Gorbag targeted Ukrainian public-sector and defense organizations with spearphishing emails disguised as administrative fines and tax matters. The messages delivered malicious files that stole browser passwords, VPN settings, documents, and electronic-signature keys,…
Russia-aligned group Gorbag targeted Ukrainian government, justice, defense, and military-aid transport organizations with phishing emails carrying malicious attachments. The emails were disguised as official administrative fine or tax documents, and opening them enabled theft of passwords, VPN…
Russia-aligned Gorbag targeted Ukrainian government, law-enforcement, and defense organizations with spear-phishing emails disguised as official administrative fines or tax notices. The emails carried malicious attachments, including macro-enabled Excel files, that installed data-stealing malware…
Researchers say the Kazakhstan-linked group “Silent Lynx” has run real espionage campaigns across Central Asia, targeting government bodies and energy organizations. The reported entry method relied heavily on spear‑phishing sent from compromised government email accounts, sometimes using trusted…
ESET reports that Russia-aligned group UAC-0099 is using spearphishing emails with malicious links to deliver a downloader called MATCHBOIL. The attack relies on tricking a person into manually running a downloaded VBScript, which then fetches and installs further malware and sets up persistence…
Microsoft reports real-world Star Blizzard phishing campaigns where victims who engage with an initial email receive a follow-up message containing a password-protected ZIP/RAR attachment. The attachment chain hides a malicious shortcut disguised as a PDF, opening a decoy file while quietly…
