Threat actor Gorbag targets Ukrainian organizations using spear-phishing lures, macro-enabled Excel spreadsheets, and info stealers like BeautyStealer and GIFTEDCROOK.
Campaigns have leveraged a patched WinRAR vulnerability (CVE-2025-8088) and included prompt injection techniques aimed at AI assistants.
The group has been active since at least February 2025. The attacks are focused on Ukrainian targets, with an emphasis on law enforcement agencies, local administrations near the front lines, and the defense sector. This activity is also linked to other groups monitored by security experts.
How attacks are carried out
The attacks begin with emails containing fake official documents, such as administrative fines or tax notices. These emails are accompanied by malicious files. In some cases, a spreadsheet file with automated commands that execute malicious software was used.
In other attacks, the group exploited a known security flaw in a popular file compression program to trigger the download of data-stealing programs.
Information theft tools
The group uses programs such as GIFTEDCROOK and BeautyStealer. These tools can gather important information from web browsers, such as history, login data, and cookies, as well as network settings, important documents, office files, databases, and remote connection settings.
↳
READ ALSO
HACKS.GR / RELATED
Cyber Attacks & Data Breaches
Algosystems offers specialized cybersecurity solutions to Healthcare organizations
↗
The stolen data is sent either to a messaging app or to the attackers' server. These programs then delete themselves from the computer, allowing the attackers to quickly gather information without leaving much of a trace.
In initial attacks, the group also used a remote control tool. In fact, in a variant of this program, the attackers had added hidden messages in an attempt to fool artificial intelligence and security utilities. However, practical tests showed that the artificial intelligence systems correctly recognized the threat and were not fooled.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
Top comments (0)