ESET links Gorbag data theft to Ukrainian wartime targets

Russia-aligned hackers known as Gorbag are using information-stealing malware against Ukrainian organizations, ESET reported. The group favors law enforcement, justice bodies, local administrations near the front line and the defense sector. Government-themed phishing attachments deliver tools that collect browser authentication data, VPN configurations and documents. BeautyStealer sends collected files to an attacker-controlled Telegram chat or server, then removes itself from the compromised computer. ESET said the theft could support an initial-access brokerage operation, with stolen information passed to other attackers, but later stages of that possible intrusion chain remain unobserved.