A Russia-aligned group called Gorbag is using basic data-stealing software against Ukrainian police, courts and local governments, and its tricks work anywhere.
Security firm ESET says a Russia-aligned hacking group known as Gorbag has been quietly stealing passwords, VPN settings and documents from Ukrainian organizations. The tools are simple. The group relies on fake official emails and a data-stealing program rather than anything advanced. ESET researcher Damien Schaeffer put it this way: cyber espionage does not always require sophisticated malware.
Gorbag has been active since at least February 2025 and has focused only on Ukrainian targets. ESET says it prefers law enforcement and justice bodies, local administrations near the front line, and the defense sector. ESET says those choices closely match Russia's wartime intelligence priorities. Ukraine's national cyber response team, CERT-UA, tracks the same activity as UAC-0226. Trend Micro calls it SHADOW-EARTH-066.
It starts with a targeted phishing email, meaning a message written for a specific victim. The attachment looks official, with themes such as administrative fines or taxes. In one case, the file was an Excel spreadsheet with macros, which are small built-in programs. Opening it and allowing macros runs hidden code that installs a stealer called BeautyStealer.
Earlier this June, Trend Micro also tied the group to attacks that abused a now-patched flaw in WinRAR, a popular file compression tool. That flaw is tracked as CVE-2025-8088. It was used to launch an older stealer called GIFTEDCROOK.
BeautyStealer pulls saved data from Chrome, Edge, Opera and Firefox. It also hunts for several kinds of files:
The loot is packed into an archive and sent to a Telegram chat or a server the attackers control. Then the program deletes itself. ESET says that points to a quick grab of information rather than a long stay on the computer.
The VPN settings and documents raise a possibility. Gorbag may be an initial access broker, a group that breaks in and hands stolen data to others. ESET says that if so, this may be only the first stage of a longer intrusion, and the later stages have not been seen. BeautyStealer is an evolution of GIFTEDCROOK, and Gorbag has used only that version since the end of December 2025.
One earlier tool, a reverse shell that lets attackers send commands to an infected computer, carried a note aimed at AI assistants claiming the file was harmless. ESET tested two AI assistants and says the trick failed.
The same lures work against any business. Do not enable macros in a file you did not expect, even if it looks like a fine or tax notice. Keep WinRAR updated so the patched flaw cannot be used against you.
Never enable macros in an unexpected file, and keep WinRAR updated, because simple fake-fine emails are still how these data thieves get in.
A tax law firm warns that 2026 tax scams use fake numbers, copycat websites and AI voices, and that a rushed demand for money is the biggest warning sign.
Read more: How to spot a tax scam before you send money or personal detailsA user says Anthropic's Claude Code put his email in web requests, then scam messages arrived. The link is unproven, but it shows what AI tools can share.
Read more: User says Claude Code sent his email address to websitesA federal judge says Delta must face a proposed class action over window seat fees, a case that could cost the airline millions and affects anyone who pays extra for a seat.
Read more: Judge says Delta must face class action over window seat fees
