Gorbag APT targets Ukrainian courts and city councils with malware

# Gorbag APT targets Ukrainian courts and city councils with malware

https://gcdradar.vercel.app/incidents/gorbag-apt-targets-ukrainian-courts-and-city-councils-with-m · AIR-2026-1724 · live

- Lane: Breaches & attacks
- Severity: 3 (Confirmed exploitation): Confirmed cyberespionage campaign against named organizations.
- Fix status: No fix needed
- First reported: 2026-11-03 (happened 2025-02)
- AI role: No AI role
- Products: Ukrainian courts and city council systems

## Summary

A Russia-aligned threat group tracked as Gorbag has been infiltrating Ukrainian law enforcement and local administration bodies. The attackers use spearphishing attachments to deploy self-deleting stealers.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-11-03: The Gorbag APT group exploits a WinRAR vulnerability to deploy its data-stealing malware. (https://thehackernews.com/2026/11/russia-aligned-gorbag-hackers-exploit.html)
- 2026-11-03: Gorbag APT group hits Ukrainian courts and city councils with self-deleting malware (https://helpnetsecurity.com/2026/11/03/gorbag-apt-group-malware)

## Sources

- 2026-11-03 Help Net Security: Gorbag APT group hits Ukrainian courts and city councils with self-deleting malware https://helpnetsecurity.com/2026/11/03/gorbag-apt-group-malware
- 2026-11-03 The Hacker News: Russia-Aligned Gorbag Hackers Exploit WinRAR Flaw to Deploy Data-Stealing Malware https://thehackernews.com/2026/11/russia-aligned-gorbag-hackers-exploit.html

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.