The group, dubbed Gorbag, has been active since at least February 2025, according to a report published Tuesday by cybersecurity firm ESET. The hackers use relatively simple malware to steal sensitive documents, login credentials and other information from Ukrainian organizations, particularly those near the front line and the Russian border. Unlike more sophisticated cyberespionage groups that seek to maintain access to compromised networks for months, Gorbag appears focused on stealing information quickly before removing traces of its malware, researchers said.
The group's targets closely align with Russia's wartime intelligence priorities, including monitoring Ukrainian war crimes investigations, assessing damage from Russian strikes and gathering information about military supplies and local defense activities. About a quarter of the group's known targets are Ukrainian law enforcement and judicial institutions, according to ESET. Researchers said the attacks could be aimed at monitoring investigations into alleged Russian war crimes and efforts to identify Russian operatives and collaborators inside Ukraine. Another quarter are local government bodies, mostly city councils in areas close to the front line.
