Russian cyberespionage group targets Ukrainian sector with infostealer malware

A Russia-aligned cyberespionage group has been targeting Ukrainian law enforcement, local governments, and the defense sector using an information-stealing malware. BankInfoSecurity reported that cybersecurity firm ESET is tracking the group under the name Gorbag. The group relies on a simple infostealer called BeautyStealer to harvest system credentials, virtual private network configurations, and sensitive files from compromised systems. [1]

According to BankInfoSecurity, the Gorbag group has been delivering malicious attachments through spear-phishing emails since February 2025. The attack campaign targets Ukrainian organizations located near the front lines of the war with Russia. Rather than deploying sophisticated implants for long-term access, the operators focus on exfiltrating secrets that are valuable to initial access brokers. [1]

The targeting aligns with broader cyber activity directed at Ukrainian computer systems. As FTMQ Security reported earlier, ESET previously documented another campaign by a Russia-aligned group known as UAC-0099, which utilized the MATCHBOIL downloader to target Windows systems across Ukrainian energy, government, transportation, and defense sectors. [5]

Malware such as infostealers and form grabbers operate by retrieving sensitive log-in credentials directly from web forms before data travels across the network to a secure server. This technique bypasses traditional transport-layer encryption such as HTTPS. Security teams monitoring Ukrainian defense and government infrastructure continue to track these exfiltration tactics. [1][3]