# ESET links Gorbag data theft to Ukrainian wartime targets

_Published Tuesday, November 3, 2026 at 8:25 AM EST · Security · Latest · Tier 2 — Notable_

![ESET links Gorbag data theft to Ukrainian wartime targets — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiqyPfrBB7GYTnYsvVj2TxCv0pPwFh_PkVpdQcxuspKgQfbsX1p2kDSdokIyPqLsxSfBCkFPiTATfZxZRbouqkoqfEESL7CgA-MyXD61eQFluiQtdFZDyXQc_3EUAg71JWIHxq9MPVLrwwegvUVuiViE8AxsKH6iBVypWazO0wmCoaC3-D1Ih9Yw3vwN1FJ/s1700-nu-rw-lo-l85-e365/russia-hackers.jpg)

Russia-aligned hackers known as Gorbag are using information-stealing malware against Ukrainian organizations, ESET reported. The group favors law enforcement, justice bodies, local administrations near the front line and the defense sector.

Government-themed phishing attachments deliver tools that collect browser authentication data, VPN configurations and documents. BeautyStealer sends collected files to an attacker-controlled Telegram chat or server, then removes itself from the compromised computer. ESET said the theft could support an initial-access brokerage operation, with stolen information passed to other attackers, but later stages of that possible intrusion chain remain unobserved.

## Sources

- [The Hacker News](https://thehackernews.com/2026/11/russia-aligned-gorbag-hackers-exploit.html)

---
Canonical: https://techandbusiness.org/newswire/CdNHYz02z9LFrL6PZf-uVx
Published: 2026-11-03T13:25:41.951Z
Story chronology: 2026-11-03T11:00:00.000Z
Retrieved: 2026-11-03T16:04:10.701Z
Publisher: Tech & Business (techandbusiness.org)