Date: 11/11/2026
Severity: Medium
Summary
Gorbag is a Russia-aligned threat actor active since at least February 2025, primarily targeting Ukrainian law enforcement, justice institutions, frontline local administrations, and defense organizations. The group uses spear-phishing emails with malicious attachments to deploy tools such as Prime ReverseShell and BeautyStealer, which steal browser credentials, VPN configurations, and sensitive documents. Rather than maintaining long-term access, Gorbag focuses on rapid intelligence collection and may operate as an initial access broker, sharing stolen information with other threat actors for further operations. In early 2026, the group also exploited the WinRAR vulnerability CVE-2025-8088 to deliver its malware.
Indicators of Compromise (IOC) List
IP Address | 89.44.9.186 142.111.194.73 |
Hash | 388374f8478203844f854ffe213f7a47
0a178f76c48c038e8bad03a62b52cfc9
fe18af8be6a9d1208fa6edf813f80c32
8428b0aa33d76b5cc681dfce6e61ced0
e27e0d0a4b308f9b6b0469159931eb5e343e7ff8
a5e0a82bf6cc302a20d917235643b748f73fcc27
0589d2079fbef814dc7bb95c4b3b555c8b933af6
c17369b4b49113d07f080df832e218156fb0940f
9ce0f41d6e575aca81d290b3d0b89b011da4f9b87276b27d1c7de81695d4c927
78ea83bfbca85a39e59fa35c8f704873f3fdad3a5278430e75286247530042b8
583754e5e682ea83d58fbf76ea5c82ea0f2ab5db06e9e52343c4d52f35f0a4a6
bc77054ea7d262fcccde9d6f1df122c1b700b0699679217d1b15ea6570ec3f2c
|
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | dstipaddress IN ("142.111.194.73","89.44.9.186") or srcipaddress IN ("142.111.194.73","89.44.9.186") |
Detection Query 2 : | md5hash IN ("0a178f76c48c038e8bad03a62b52cfc9","388374f8478203844f854ffe213f7a47","8428b0aa33d76b5cc681dfce6e61ced0","fe18af8be6a9d1208fa6edf813f80c32")
|
Detection Query 3 : | sha1hash IN ("0589d2079fbef814dc7bb95c4b3b555c8b933af6","c17369b4b49113d07f080df832e218156fb0940f","a5e0a82bf6cc302a20d917235643b748f73fcc27","e27e0d0a4b308f9b6b0469159931eb5e343e7ff8")
|
Detection Query 4 : | sha256hash IN ("bc77054ea7d262fcccde9d6f1df122c1b700b0699679217d1b15ea6570ec3f2c","583754e5e682ea83d58fbf76ea5c82ea0f2ab5db06e9e52343c4d52f35f0a4a6","9ce0f41d6e575aca81d290b3d0b89b011da4f9b87276b27d1c7de81695d4c927","78ea83bfbca85a39e59fa35c8f704873f3fdad3a5278430e75286247530042b8")
|
Reference:
Gorbag Cyberespionage Campaign Targets Ukraine