A previously unidentified Russia-aligned hacking group has been targeting Ukrainian government agencies, defense organizations and infrastructure used to transport foreign military aid, researchers have found.

The group, dubbed Gorbag, has been active since at least February 2025, according to a report published Tuesday by cybersecurity firm ESET. The hackers use relatively simple malware to steal sensitive documents, login credentials and other information from Ukrainian organizations, particularly those near the front line and the Russian border.

Unlike more sophisticated cyberespionage groups that seek to maintain access to compromised networks for months, Gorbag appears focused on stealing information quickly before removing traces of its malware, researchers said.

The group's targets closely align with Russia's wartime intelligence priorities, including monitoring Ukrainian war crimes investigations, assessing damage from Russian strikes and gathering information about military supplies and local defense activities.

About a quarter of the group's known targets are Ukrainian law enforcement and judicial institutions, according to ESET. Researchers said the attacks could be aimed at monitoring investigations into alleged Russian war crimes and efforts to identify Russian operatives and collaborators inside Ukraine.

Another quarter are local government bodies, mostly city councils in areas close to the front line. These institutions often collect information about damage caused by Russian airstrikes, including assessments of critical infrastructure and estimated repair times that are not publicly disclosed.

Access to such records could help Russian forces evaluate the effectiveness of their attacks, ESET said. The hackers may also be seeking information about local defense initiatives, including recruitment, military training and civil defense preparations.

Other targets include Ukrainian defense organizations and an entity identified by researchers as a major transportation hub for foreign military assistance. ESET did not name the facility but said it had previously been targeted by Russian airstrikes. The hackers could be seeking intelligence on incoming military supplies and the damage inflicted on transportation infrastructure, researchers said.

Gorbag's operations rely primarily on phishing emails containing malicious attachments, often disguised as official documents concerning administrative fines or taxes.

Once a victim opens an attachment, the hackers can steal saved browser passwords, cookies, VPN configurations and selected files, including Microsoft Office documents, email records and archives.

The group's main information-stealing tool, dubbed BeautyStealer, searches computers, removable storage devices and connected network drives for potentially valuable files. It then attempts to delete itself after transmitting the stolen information.

Gorbag also uses a tool called Prime ReverseShell, adapted from publicly available code, that allows attackers to remotely execute commands on compromised computers.

In early 2026, the hackers changed their methods to exploit a previously disclosed security vulnerability in WinRAR, a widely used file-archiving program. The flaw, tracked as CVE-2025-8088, allows attackers to execute malicious code when a victim opens a specially crafted archive. It was patched in July 2025 and had previously been exploited by RomCom, another Russia-aligned hacking group linked to cybercrime and espionage.

ESET said Gorbag's preference for quickly collecting information rather than maintaining persistent access could indicate that it works with other hacking groups, passing stolen credentials and documents to operators who carry out subsequent intrusions. Researchers have not established whether such cooperation is taking place.

"Despite its relatively unsophisticated toolset, the group demonstrates precise targeting and operational intent to contribute to Russia’s broader strategic goals in the war with Ukraine," ESET said. "As long as the war in Ukraine continues, we expect groups such as Gorbag to remain a persistent threat to Ukrainian governmental, justice, and defense entities."