Gorbag APT group hits Ukrainian courts and city councils with self-deleting malware

ESET has been tracking a Russia-aligned group it calls Gorbag, which has been breaking into Ukrainian organizations since at least February 2025 using spearphishing attachments and a stealer that erases itself once the data is gone, Help Net Security reports. Every target identified sits in Ukraine: about a quarter are law enforcement and justice bodies, and another quarter are local administrations, mostly city councils near the front line.