For awareness Medium Monitor
Russia-aligned Gorbag group spies on Ukrainian public and defence bodies
Industrial Cybergovernment, defence, transport
What happened. ESET reports a Russia-aligned group, Gorbag, has run spearphishing espionage against Ukrainian organisations since at least February 2025. It steals browser credentials, VPN configurations and documents, and may pass access to other actors.
Who is affected. Ukrainian law enforcement and justice bodies, front-line local administrations, defence organisations and a major transport hub for foreign military aid.
What to do. Brief staff on spearphishing attachments and review how VPN configurations and browser-stored passwords are protected on office computers.
When to act. For awareness: no sign it reaches your site
Editor's reading
Fordetection engineerIT security
- Purdue level
- L4
Why: The group relies on spearphishing emails and infostealers on office workstations, which are enterprise IT systems at L4.
- Are you exposed?
Check mail logs for macro-enabled attachments and endpoint logs for PowerShell reverse shells and access to OpenVPN configuration files.
- If you cannot fix it yet
- Block or sandbox macro-enabled and other risky email attachments.
- Stop staff storing passwords in browsers and protect VPN configuration files.
- Require multi-factor authentication on VPN and remote-access accounts.
- Watch for
- PowerShell launching reverse-shell connections to unfamiliar external hosts after an email attachment is opened.
- Unexpected access to browser credential stores or OpenVPN configuration files.
- ATT&CK for ICS
- T0865Spearphishing Attachment
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: Industrial Cyber (opens industrialcyber.co)
More on Government Defence and aerospace Transport