Threats tagged 'gorbag'

Gorbag is a Russia-aligned cyberespionage threat actor active since February 2025, targeting Ukrainian law enforcement, justice entities, local administrations near the front line, and defense sectors. The group uses spearphishing emails with malicious attachments to gain initial access and employs simple infostealers for rapid data collection, including browser credentials, VPN configurations, and selected documents. Their toolset includes Prime ReverseShell and BeautyStealer. In early 2026, Gorbag incorporated exploitation of CVE-2025-8088, a WinRAR path traversal vulnerability, into their attack chain. The group appears to focus on quick intelligence harvesting rather than long-term persistence, possibly acting as an initial access broker sharing credentials with other Russia-aligned actors.

KEVEPSS 94%Report on CVE-2025-8088MalwareCWE-35#prime reverseshellUkraine